Backport of security patch, for benefit of yargs

[bcoe]

I know it's a pain in the neck, but would you consider back-porting #37 to the 5.x.x release line, for the benefit of yargs.

Yargs is making the effort during the transition to ESM to support both CJS and ESM, which makes us unable to update to the latest version of string-width.

If you were willing to make an exception (I know you're pushing folks towards using ESM exclusively) it would be really valuable for yargs users using CJK character sets.

[Qix-]

Sure thing, give me a moment.

[Qix-]

Released as 5.0.1 :) Let me know if there's anything else.

[bacali95]

Hello @yetingli, can you please edit the vulnerability information in Snyk (https://app.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908) since the vulnerability fix is backported to version 5.0.1? Thanks 😄

[yetingli]

Hey @bacali95, I don't seem to have permission to edit them. Hi Colin @colin-ife-snyk, can you please edit the vulnerability information? Thanks a lot!

[colin-ife-snyk]

Hey @bacali95, I don't seem to have permission to edit them. Hi Colin @colin-ife-snyk, can you please edit the vulnerability information? Thanks a lot!

No problem. Will be updated later today.

[bacali95]

Thanks a lot @yetingli @colin-ife-snyk 🌹

[sindresorhus]

The range in the report says <5.0.1 but it has not been proven that all versions below 5.0.0 are vulnerable. (Snyk: You should generally not just assume all previous versions are affected by default).

[sindresorhus]

@colin-ife-snyk @yetingli ⬆️

[cardil]

GitHub Advisory Database still lists this package as affected for <6.0.1, here: GHSA-93q8-gq69-wqmw

Anyone knows how to update that information as well?

This page https://docs.github.com/en/code-security/security-advisories/creating-a-security-advisory suggest the repo owner should be able to edit this information.