Please fix security issues.

[Mister-Hope]

[Mister-Hope]

Also, is there any strong reson why commitizen choose to lock minimist version? No other packages in my project is doing that.

[kilahm]

See #913 - looks like the auto-merge of the dependency update is waiting on the stabilityDays setting of RenovateBot. I tried to find the value, but I was unable to trace it beyond https://github.com/commitizen/commitizen-renovate-config/blob/master/default.json

[Mister-Hope]

I am just curious why this dep's version is fixed. If we do not pin it with an exact version, this can be fixed by updating deps myself.

[Mister-Hope]

any update about this one?

[LinusU]

I very much prefer non-pinned dependencies myself, but it was made this way before I started contributing. These days I'm not personally using this tool, and I believe that the publishing workflow doesn't work anymore (#897). Because of this I don't have much bandwidth to fix things here...

If it sounds like a good way forward, I would be open to merging a pull request that changes the dependencies to be specified with ^ (it would need to update the renovate config as well), and then doing a manual release from my computer 🚀

[urecio]

Hi, any update on this? Looks like only publishing is needed now

[zSakuraEvilz]

Hi, any update on this? I need to use it but still have security issues. So my company does not allow the use.

[Mister-Hope]

Half a month bro 🤡, any schedule? Or shall I fork and publish a temp version first?

[Mister-Hope]

Just noticed that the Severity is lifted to Critical. And I am sure that this will bother many people due to their company policity.

[Mister-Hope]

@jimthedev Help needed here

[techmunk]

We worked around this using the overrides package.json property added in npm v8. Something like the below:

  "overrides": {
    "commitizen": {
      "inquirer": "8.2.0",
      "minimist": "1.2.6"
    }
  }

Not ideal, but might help some people move forward. I had to remove node modules and possibly package-lock.json as well before doing npm install to get the changes to take effect.

Commitizen seems to be working fine with these changes, and npm audit is happy now too.

[caleb-mabry]

If the above solution doesn't work for you, we used https://www.npmjs.com/package/npm-force-resolutions to resolve the vulnerability for the time being.

[noahnu]

If using Yarn modern, you can set this resolution in your project's package.json (equivalent of npm overrides):

"minimist@1.2.5": "npm:1.2.6"