chore: bump yargs parser version to avoid flagged vulnerable dependencies

[ashokdelphia]

Description

Update the version of yargs used in gatsby-dev-cli and gatsby-cli.

• Bump the yargs version to address some 'low' security vulnerability warnings. (01df9d4)

  'npm audit' complains for:

  • yargs > os-locale > mem (https://npmjs.com/advisories/1084)
  • yargs > yargs-parser (https://npmjs.com/advisories/1500)

  This is obviously a big jump in major version numbers, but the usage looks reasonably vanilla, so I'm hoping it's obvious whether this breaks anything.

• Bump the yargs version to address a 'low' security vulnerability warning in yargs-parser. (65b09f0)

  'npm audit' complains about 'yargs > yargs-parser' (https://npmjs.com/advisories/1500).

Documentation

N/A

Related Issues

This should fix the yargs-parser part of #23004.

[pieh]

We will need more changes than just bump - there were some breaking changes that we need to account for. I didn't do full check yet but few that I found so far that needs to be addressed:

Per https://github.com/yargs/yargs/releases/tag/v15.0.0

remove package.json-based parserConfiguration

Which we use in

gatsby/packages/gatsby-cli/package.json

Lines 86 to 88 in b9836da

	"yargs": {
	"boolean-negation": false
	},

That no longer has effect and we need to find a way to apply it in different way or adjust code to not need it.

I was actually going over those right now and working on it - but might as well use your pull request ;)

[ashokdelphia]

I was actually going over those right now and working on it - but might as well use your pull request ;)

Thanks for checking more closely.

Happy to leave it with you, but if I can be of any assistance, please let me know.

[pieh]

I will be updating this PR - if you want to do additional research on breaking changes and manual testing - I will for sure welcome another set of eyes and hands on this

[pieh]

Also note - we will need to track webpack/webpack-dev-server#2566 as well because that's dependency of gatsby (so this PR alone will not fix audit completely). Using this PR we still get:

➜  pr23839 git:(master) ✗ yarn audit    
yarn audit v1.21.0
warning ../package.json: No license field
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gatsby > webpack-dev-server > yargs > yargs-parser           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1500                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 36236

For comparison - using latest we get 2 entries:

yarn audit    
yarn audit v1.21.0
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gatsby > gatsby-cli > yargs > yargs-parser                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1500                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ yargs-parser                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=13.1.2 <14.0.0 || >=15.0.1 <16.0.0 || >=18.1.2             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gatsby                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gatsby > webpack-dev-server > yargs > yargs-parser           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1500                        │
└───────────────┴──────────────────────────────────────────────────────────────┘
2 vulnerabilities found - Packages audited: 36257

[pieh]

Looks good

[gatsbot]

Holy buckets, @ashokdelphia — we just merged your PR to Gatsby! 💪💜

Gatsby is built by awesome people like you. Let us say “thanks” in two ways:

1. We’d like to send you some Gatsby swag. As a token of our appreciation, you can go to the Gatsby Swag Store and log in with your GitHub account to get a coupon code good for one free piece of swag. We’ve got Gatsby t-shirts, stickers, hats, scrunchies, and much more. (You can also unlock even more free swag with 5 contributions — wink wink nudge nudge.) See gatsby.dev/swag for details.
2. We just invited you to join the Gatsby organization on GitHub. This will add you to our team of maintainers. Accept the invite by visiting https://github.com/orgs/gatsbyjs/invitation. By joining the team, you’ll be able to label issues, review pull requests, and merge approved pull requests.

If there’s anything we can do to help, please don’t hesitate to reach out to us: tweet at @gatsbyjs and we’ll come a-runnin’.

Thanks again!