[Aikido] Fix security issue in yargs via major version upgrade from 17.7.2 to 18.1.0

[aikido-autofix]

Upgrade yargs to fix prototype pollution vulnerability in configuration merging that could allow attackers to manipulate object prototypes through malicious config inputs.

✅ Code not affected by breaking changes.

✅ No breaking changes affect this codebase. The package yargs is not directly used in the project - it only appears as a transitive dependency through jest-cli and nx. There are no imports, requires, or usage of yargs APIs in any source files. The breaking changes related to command names, singleton usage, Node.js version requirements, and ESM-first approach do not impact this codebase.

All breaking changes by upgrading yargs from version 17.7.2 to 18.1.0 (CHANGELOG)

Version	Description
18.0.0	Command names are not derived from modules passed to command.
18.0.0	Singleton usage of yargs yargs.foo, yargs().argv, has been removed.
18.0.0	Minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
18.0.0	yargs is now ESM first

✅ 1 CVE resolved by this upgrade

This PR will resolve the following CVEs:

Issue	Severity	Description
AIKIDO-2026-922647	LOW	[yargs] Prototype pollution vulnerability in recursive configuration merging allows attackers to pollute object prototypes through __proto__ keys, potentially enabling arbitrary property manipulation and code execution.

🤖 Remediation details

Fix transitive yargs vulnerability via resolutions override

Short summary

This PR fixes a vulnerability in the transitive dependency yargs (versions < 18.1.0), which was being resolved at 17.7.2 across the workspace. The fix is applied in the root package.json (via a resolutions entry) and the corresponding yarn.lock was refreshed to reflect the new resolved version.

yargs

yargs@17.7.2 was pulled in transitively by two parents: jest-cli@29.7.0 (declaring ^17.3.1) and nx@20.8.4 (declaring ^17.6.2). A full parent-chain analysis confirmed that no published version of any ancestor — including the latest releases of jest-cli, nx, and all @nx/* packages — ever declares a yargs range that admits >= 18.1.0; the latest nx canary still pins yargs at exactly 17.7.2. Because no parent bump can deliver the patched version, a resolutions entry of "yargs": "^18.1.0" was added to the root package.json, and the lockfile was refreshed with yarn install --mode=update-lockfile, resolving yargs to 18.1.0. Several new packages (cliui, string-width, ansi-styles, etc.) were added to the lockfile as updated dependencies of yargs@18.x, and require-directory (a yargs@17.x-only dependency) was removed.

Version changes

Package	From	To	Why updated
yargs	17.7.2	18.1.0	Direct CVE fix via resolutions override
cliui	not present	9.0.1	Lockfile refresh — new dependency of yargs@18.x
string-width	(prior version)	7.2.0	Lockfile refresh — new dependency of yargs@18.x
ansi-styles	(prior version)	6.2.3	Lockfile refresh — new dependency of yargs@18.x
ansi-regex	(prior version)	6.2.2	Lockfile refresh — new dependency of yargs@18.x
emoji-regex	(prior version)	10.6.0	Lockfile refresh — new dependency of yargs@18.x
get-east-asian-width	not present	1.6.0	Lockfile refresh — new dependency of yargs@18.x
require-directory	2.1.1	removed	Lockfile refresh — no longer required by yargs@18.x