[Snyk] Upgrade commander from 2.11.0 to 2.20.3

[NOUIY]

This PR was automatically created by Snyk using the credentials of a real user.

Snyk has created this PR to upgrade commander from 2.11.0 to 2.20.3.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 16 versions ahead of your current version.
• The recommended version was released 4 years ago, on 2019-10-11.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Incomplete List of Disallowed Inputs SNYK-JS-BABELTRAVERSE-5962462	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Proof of Concept
	Command Injection SNYK-JS-LODASH-1040724	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-450202	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-567746	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Proof of Concept
	Prototype Pollution SNYK-JS-LODASH-608086	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-LODASH-1018905	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Proof of Concept
	Regular Expression Denial of Service (ReDoS) npm:debug:20170905	786/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 9.3	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: commander

• 2.20.3 - 2019-10-11
  

  Ran "npm unpublish commander@2.20.2". There is no 2.20.2.

  Fixed

  • Support Node.js 0.10 (Revert #1059)
• 2.20.1 - 2019-09-28
  

  Fixed

  • Improve tracking of executable subcommands.

  Changed

  • update development dependencies

  Credits:

  • issue identified by Checkmarx Application Security Research Team
• 2.20.0 - 2019-04-03
  
  • fix: resolve symbolic links completely when hunting for subcommands (#935)
  • Update index.d.ts (#930)
  • Update Readme.md (#924)
  • Remove --save option as it isn't required anymore (#918)
  • Add link to the license file (#900)
  • Added example of receiving args from options (#858)
  • Added missing semicolon (#882)
  • Add extension to .eslintrc (#876)
• 2.19.0 - 2018-10-08
  
  • Removed newline after Options and Commands headers (#864)
  • Bugfix - Error output (#862)
  • Fix to change default value to string (#856)
• 2.18.0 - 2018-09-07
• 2.17.1 - 2018-08-07
• 2.17.0 - 2018-08-04
• 2.16.0 - 2018-06-29
• 2.15.1 - 2018-03-20
• 2.15.0 - 2018-03-08
• 2.14.1 - 2018-02-07
• 2.14.0 - 2018-02-06
• 2.13.0 - 2018-01-11
• 2.12.2 - 2017-11-28
• 2.12.1 - 2017-11-23
• 2.12.0 - 2017-11-22
• 2.11.0 - 2017-07-03

from commander GitHub release notes

Commit messages

Package name: commander

• 6b8499b Version bump 2.20.3 (Possible memory leak in TLS(Wrap?) nodejs/node#1075)
• a591f87 Support Node.js 0.10 (Revert buffer: make indexOf faster nodejs/node#1059) (fs: read whole file only in regular files nodejs/node#1074)
• 48b02f0 Improve 2.x executable subcommand tracking and update dependencies (buffer: make indexOf faster nodejs/node#1059)
• 3e8bf54 Merge pull request Documents API changes in #256 nodejs/node#946 from abetomo/version_bump_2.20.0
• 1ffcbef version bump 2.20.0
• 50922d8 Merge pull request util: discrepancy in format() docs vs behavior nodejs/node#935 from MarshallOfSound/fix-deep-sym-link-resolution
• 994d24d fix: resolve symbol links until their are no more symbolic links
• 291fc04 Merge pull request Remove stability designations in core JS API nodejs/node#930 from kira1928/update-index.d.ts
• a469137 some more fix.
• a679949 Refine variable name. Use strict type definition instead of
• e31bb8a Update index.d.ts
• 4542306 Merge pull request build: Fix incorrect reference nodejs/node#924 from ForJing/patch-1
• 77bb580 Update Readme.md
• 68545af Remove --save option as it isn't required anymore
• 82d0d0a fix url 🚧
• cec57f5 Add link to the license file 👍
• d240081 Update Readme.md
• 03f7d38 Added example of receiving args from options
• 27aeac1 Merge pull request Integrating v8 with GNU's Libmicrohttpd  nodejs/node#882 from reviewher/patch-1
• f054510 Added missing semicolon
• 700130e Add extension to .eslintrc
• 78b7dbd version bump 2.19.0
• 6aafa20 prefixed error messages with "error:"
• 6c0c1f6 removed newline above and below errors

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs