Moderate vulnerability in dependency yargs-parser

[moay]

Our CI just yelled at us, there is a vulnerability in yargs-parser. The vulnerability is patched, so maybe the patched version could be used?

Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @symfony/webpack-encore                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @symfony/webpack-encore > webpack-dev-server > yargs >       │
│               │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @symfony/webpack-encore                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @symfony/webpack-encore > yargs-parser                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1500                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Relevant part of the dependency tree:

├─┬ @symfony/webpack-encore@0.29.1
│ ├─┬ webpack-cli@3.3.11
│ │ └─┬ yargs@13.2.4
│ │   └── yargs-parser@13.1.2
│ ├─┬ webpack-dev-server@3.10.3
│ │ └─┬ yargs@12.0.5
│ │   └── yargs-parser@11.1.1
│ └── yargs-parser@12.0.0

The direct dependency is outdated as well as the dependency via webpack-dev-server. Both cannot be patched by using npm audit fix

[stof]

For the webpack-dev-server dependency, this should be reported to https://github.com/webpack/webpack-dev-server

[stof]

Actually, they already have a PR updating it at webpack/webpack-dev-server#2566