electron / electron/forge

Using an outdated version of inquirer/prompts which relies on outdated version of other inquirer packages with vulnerabilities

Open
#4,054 0 comments 3 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
7.1k
Forks
641
Avg merge
3d 1h
Merged PRs (30d)
30

Description

### Pre-flight checklist

- [x] I have read the [contribution documentation](https://github.com/electron/forge/blob/main/CONTRIBUTING.md) for this project.
- [x] I agree to follow the [code of conduct](https://github.com/electron/electron/blob/main/CODE_OF_CONDUCT.md) that this project uses.
- [x] I have searched the issue tracker for a bug that matches the one I want to file, without success.

### Forge version

7.10.2

### Electron version

33.3.1

### Operating system

macOS Tahoe 26.1

### Last known working Forge version

7.10.2

### Expected behavior

shouldn't have any security vulnerabilities

### Actual behavior

the version of inquirer/prompts that is being used uses an old version inquirer/editor which is using an old version of external-editor that is now deprecated and using a vulnerable version of tmp - if you update the inquirer/prompts package to the most recent there will be no more vulnerabilities

### Steps to reproduce

run an audit

### Additional information

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.