Upgraded yargs package to fix #7444

[c16a]

What it does

Upgades the version of yargs package to fix https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

How to test

Tests can be run with yarn test from the examples/browser directory.

Review checklist

• as an author, I have thoroughly tested my changes and carefully followed the review guidelines

Reminder for reviewers

• as a reviewer, I agree to behave in accordance with the review guidelines

[vince-fugnitto]

I verified that the new dependency version for yargs is license compatible using the steps as described here.

[c16a]

@vince-fugnitto let me know if this is good to go.

[vince-fugnitto]

@vince-fugnitto let me know if this is good to go.

A couple of things before proceeding:

• Please be sure to sign the Eclipse Contributor Agreement (ECA) so we can accept your changes. The last time I verified your sign-off email, no ECA was on file:

• Please be sure to squash all commits. In general, we ask that a single commit be present in a pull-request unless commits can be logically separated.

[c16a]

@vince-fugnitto - done with both. Can you check if my ECA shows up now?

[vince-fugnitto]

@vince-fugnitto - done with both. Can you check if my ECA shows up now?

Yes, the ECA looks good now thank you!
I'll wait for Travis to be green before merging, thank you for your first contribution 👍

[c16a]

@vince-fugnitto - thanks! Looks everything is good now.

[vince-fugnitto]

@vince-fugnitto - thanks! Looks everything is good now.

Was there a reason for not updating other extensions?
We also have yargs in these places:

theia/dev-packages/cli/package.json

Line 48 in f4ee12a

"yargs": "^11.1.0"

theia/dev-packages/electron/package.json

Line 30 in f4ee12a

"yargs": "^11.1.0"

cli will be in fact a devDependency in the end, but not electron as it is mandatory for electron-based theia applications. In order to align, I think we should update both of them similarly to core.

Additional changes required.

[paul-marechal]

LGTM, thanks!

[paul-marechal]

I noticed too late that it wasn't updated in the other places, but given what yarn resolved with your first modification, you should just update the other places and it will be good to go!

[akosyakov]

@marechal-p Anything else should be done to merge it?

[vince-fugnitto]

@marechal-p Anything else should be done to merge it?

We should update the other occurrences of yargs in other extensions, we can do so by updating the pull-request ourselves as there hasn't been much activity lately.

[akosyakov]

@vince-fugnitto fine with me