[security] Update `chalk` to 4.x?
Open
- Dominant language
- JavaScript
- Stars
- 7.2k
- Forks
- 621
- PR merge metrics
- No merged PRs in 30d
Description
BackstopJS currently uses a several years old version of `chalk`.
https://github.com/garris/BackstopJS/blob/fbc8bd59a77ad0be5f3ba71a97b0468bd16752b8/package.json#L87
This is a slight problem because it has a transitive dependency on `ansi-regex@2` (via `strip-ansi@3`), which has a security vulnerability: https://github.com/advisories/GHSA-93q8-gq69-wqmw.
https://github.com/garris/BackstopJS/blob/fbc8bd59a77ad0be5f3ba71a97b0468bd16752b8/package-lock.json#L1844
Would be nice to upgrade to the newest version of `chalk`. I would force resolve to `chalk@4` on my end but it might break something.
Contributor guide
Assessment
This issue has not been assessed yet.