PDE-2085 chore(cli): bump @oclif/plugin-help to ^3.2.14 to patch vulnerability in sub-dependency

[mrjackdavis]

fixes #555

[eliangcs]

Thanks for fixing! I understand conventionally you'd use a ^ or ~ to auto upgrade the dependencies. But for the packages in this repo, it's more important not to break, so we always use the exact versions to make sure the installation is as deterministic as possible.

[eliangcs]

For this repo, we always pin the exact version of a dependency, to be extra safe that nothing breaks due to accidental version bump.

Suggested change

	"@oclif/plugin-help": "~3.2.14",
	"@oclif/plugin-help": "3.2.14",

[mrjackdavis]

I patched a repo at work with this change, but unfortunately a bunch of other stuff breaks. For some reason that dependency patch version bump has a bunch of breaking changes. I'll swing back here and update the PR when I get time

[AlonNavon]

@mrjackdavis
Hey Jack, I know this is an old issue, but it's the kind of pain we exist to solve. You want to fix CVE-2021-23337 in lodash.template, but it's a transitive dependency so you have to upgrade @oclif/plugin-help, but the patch version contains breaking changes so a simple version bump won't work. Oldest story in the (open-source) world.

At Seal Security we backport security patches and release them freely to the community. So instead of upgrading @oclif/plugin-help you can just use npm's override feature and override the existing lodash.template version with our own, which is available for free on our artifact server. Hope this will be able to solve your issue (and future similar ones).

If you have any questions, feel free to contact us.

[rnegron]

Fixed in #739. Thanks for flagging this issue!