[Snyk] Upgrade commander from 3.0.1 to 12.1.0

[OKEAMAH]

Snyk has created this PR to upgrade commander from 3.0.1 to 12.1.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

• The recommended version is 49 versions ahead of your current version.

• The recommended version was released on 3 months ago.

Release notes

Package name: commander

• 12.1.0 - 2024-05-18
  

  Added

  • auto-detect special node flags node --eval and node --print when call .parse() with no arguments (#2164)

  Changed

  • prefix require of Node.js core modules with node: (#2170)
  • format source files with Prettier (#2180)
  • switch from StandardJS to directly calling ESLint for linting (#2153)
  • extend security support for previous major version of Commander (#2150)

  Removed

  • removed unimplemented Option.fullDescription from TypeScript definition (#2191)
• 12.0.0 - 2024-02-03
  

  Added

  • .addHelpOption() as another way of configuring built-in help option (#2006)
  • .helpCommand() for configuring built-in help command (#2087)

  Fixed

  • Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
  • Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)

  Changed

  • Breaking: Commander 12 requires Node.js v18 or higher (#2027)
  • Breaking: throw an error if add an option with a flag which is already in use (#2055)
  • Breaking: throw an error if add a command with name or alias which is already in use (#2059)
  • Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
  • replace non-standard JSDoc of @ api private with documented @ private (#1949)
  • .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
  • refactor internal implementation of built-in help option (#2006)
  • refactor internal implementation of built-in help command (#2087)

  Deprecated

  • .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)

  Removed

  • Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)

  Migration Tips

  global program

  If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).

  // const program = require('commander');
  const { program } = require('commander');

  option and command clashes

  A couple of configuration problems now throw an error, which will pick up issues in existing programs:

  • adding an option which uses the same flag as a previous option
  • adding a command which uses the same name or alias as a previous command
• 12.0.0-1 - 2024-01-19
  

  Added

  • .addHelpOption() as another way of configuring built-in help option (#2006)
  • .helpCommand() for configuring built-in help command (#2087)

  Changed

  • .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
  • refactor internal implementation of built-in help option (#2006)
  • refactor internal implementation of built-in help command (#2087)

  Deprecated

  • .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)
• 12.0.0-0 - 2023-11-11
  

  Fixed

  • Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
  • Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)

  Changed

  • Breaking: Commander 12 requires Node.js v18 or higher (#2027)
  • Breaking: throw an error if add an option with a flag which is already in use (#2055)
  • Breaking: throw an error if add a command with name or alias which is already in use (#2059)
  • Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
  • replace non-standard JSDoc of @ api private with documented @ private (#1949)

  Removed

  • Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)

  Migration Tips

  global program

  If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).

  // const program = require('commander');
  const { program } = require('commander');

  option and command clashes

  A couple of configuration problems now throw an error, which will pick up issues in existing programs:

  • adding an option which uses the same flag as a previous option
  • adding a command which uses the same name or alias as a previous command
• 11.1.0 - 2023-10-13
  

  Fixed

  • TypeScript: update OptionValueSource to allow any string, to match supported use of custom sources (#1983)
  • TypeScript: add that Command.version() can also be used as getter (#1982)
  • TypeScript: add null return type to Commands.executableDir(), for when not configured (#1965)
  • subcommands with an executable handler and only a short help flag are now handled correctly by the parent's help command (#1930)

  Added

  • registeredArguments property on Command with the array of defined Argument (like Command.options for Option) (#2010)
  • TypeScript declarations for Option properties: envVar, presetArg (#2019)
  • TypeScript declarations for Argument properties: argChoices, defaultValue, defaultValueDescription (#2019)
  • example file which shows how to configure help to display any custom usage in the list of subcommands (#1896)

  Changed

  • (developer) refactor TypeScript configs for multiple use-cases, and enable checks in JavaScript files in supporting editors (#1969)

  Deprecated

  • Command._args was private anyway, but now available as registeredArguments (#2010)
• 11.0.0 - 2023-06-16
  

  Fixed

  • help command works when help option is disabled (#1864)

  Changed

  • leading and trailing spaces are now ignored by the .arguments() method (#1874)
  • refine "types" exports for ESM to follow TypeScript guidelines (#1886)
  • Breaking: Commander 11 requires Node.js v16 or higher
• 10.0.1 - 2023-04-15
  

  Added

  • improvements to documentation (#1858, #1859, #1860)

  Fixed

  • remove unused Option.optionFlags property from TypeScript definition (#1844)

  Changed

  • assume boolean option intended if caller passes string instead of hash to .implies() (#1854)
• 10.0.0 - 2023-01-14
  

  Added

  • wrap command description in help (#1804)

  Changed

  • Breaking: Commander 10 requires Node.js v14 or higher
• 9.5.0 - 2023-01-07
  

  Added

  • .getOptionValueSourceWithGlobals() (#1832)
  • showGlobalOptions for .configureHelp{} and Help (#1828)
• 9.4.1 - 2022-09-30
  

  Fixed

  • .setOptionValue() now also clears option source (#1795)
  • TypeScript: add implied to OptionValueSource for option values set by using .implies() (#1794)
  • TypeScript : add undefined to return type of .getOptionValueSource() (#1794)

  Changed

  • additions to README
• 9.4.0 - 2022-07-15
• 9.3.0 - 2022-05-28
• 9.2.0 - 2022-04-15
• 9.1.0 - 2022-03-18
• 9.0.0 - 2022-01-29
• 9.0.0-1 - 2022-01-14
• 9.0.0-0 - 2021-12-22
• 8.3.0 - 2021-10-22
• 8.2.0 - 2021-09-10
• 8.1.0 - 2021-07-27
• 8.0.0 - 2021-06-25
• 8.0.0-2 - 2021-06-06
• 8.0.0-1 - 2021-05-31
• 8.0.0-0 - 2021-05-22
• 7.2.0 - 2021-03-21
• 7.1.0 - 2021-02-15
• 7.0.0 - 2021-01-15
• 7.0.0-2 - 2020-12-14
• 7.0.0-1 - 2020-11-21
• 7.0.0-0 - 2020-10-25
• 6.2.1 - 2020-12-14
• 6.2.0 - 2020-10-25
• 6.1.0 - 2020-08-28
• 6.0.0 - 2020-07-19
• 6.0.0-0 - 2020-06-20
• 5.1.0 - 2020-04-25
• 5.0.0 - 2020-03-14
• 5.0.0-4 - 2020-03-03
• 5.0.0-3 - 2020-02-20
• 5.0.0-2 - 2020-02-11
• 5.0.0-1 - 2020-02-08
• 5.0.0-0 - 2020-02-01
• 4.1.1 - 2020-02-03
• 4.1.0 - 2020-01-06
• 4.0.1 - 2019-11-11
• 4.0.0 - 2019-11-01
• 4.0.0-1 - 2019-10-08
• 4.0.0-0 - 2019-10-01
• 3.0.2 - 2019-09-26
• 3.0.1 - 2019-08-30

from commander GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[sourcery-ai]

We have skipped reviewing this pull request. Here's why:

• It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
• We don't review packaging changes - Let us know if you'd like us to change this.

[socket-security]

New and removed dependencies detected. Learn more about Socket for GitHub ↗︎

Package	New capabilities	Transitives	Size	Publisher
npm/[email protected]	environment	0	186 kB	abetomo

🚮 Removed packages: npm/[email protected]

View full report↗︎

[socket-security]

🚨 Potential security issues detected. Learn more about Socket for GitHub ↗︎

To accept the risk, merge this PR and you will not be notified again.

Alert	Package	Note	CI
Install scripts	npm/[email protected]	Install script: preinstall Source: node index.js	🚫

View full report↗︎

Next steps

What is an install script?

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Take a deeper look at the dependency

Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support [AT] socket [DOT] dev.

Remove the package

If you happen to install a dependency that Socket reports as Known Malware you should immediately remove it and select a different dependency. For other alert types, you may may wish to investigate alternative packages or consider if there are other ways to mitigate the specific risk posed by the dependency.

Mark a package as acceptable risk

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of ecosystem/package-name@version specifiers. e.g. @SocketSecurity ignore npm/[email protected] or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore npm/[email protected]