npm audit issue

[vtereshyn]

After running npm audit script got an issue with braces package which is dependency of commitizen.

commitizen version is 3.0.5

"commitizen": "^3.0.5"

[celicoo]

+1

[viane]

+1

[seantrane]

This originates through the find-node-modules dependency, and its dependency on findup-sync (v0.4.2), and its dependency on micromatch.

Both findup-sync and micromatch have been patched, and the fix is available in findup-sync > 1.0.0. But that fix is almost 2 years old. It does not look like find-node-modules is being maintained anymore.

I'm reticent to work on a PR for this without knowing which way maintainers want to go with this; refactor and remove dependency, or influence an update of find-node-modules.

[jimthedev]

Let's try to update find-node-modules. I hit up find-node-modules author on twitter to see if we can get a merge of the outstanding pr. We'll see if he replies and if so then we can do a PR for findup-sync too. Worst case we fork it and rely on the fork for a bit.

[jimthedev]

Ok this looks good he is open to a pr @seantrane https://twitter.com/callumacrae/status/1098256784287035393

[afrokick]

@seantrane https://github.com/callumacrae/find-node-modules was updated.

[callumacrae]

:)

[jimthedev]

Merged renovate PR #611

[jimthedev]

3.0.6 has the fix from downstream.

[jimthedev]

We're good. Thanks all! <3