10 moderate vulnerabilities reported due to ansi-regex dependency

[naffers]

Current behavior

Fresh installs of semantic-release are reporting 10 moderate vulnerabilities due to dependencies on ansi-regex.

Expected behavior

Installing semantic-release doesn't report 10 moderate vulnerabilities.

Environment

• semantic-release version: ^18.0.0
• CI environment: GitLab CI but is exhibited on local installations
• Plugins used: Just the one's that come by virtue of semantic-released dependency
• semantic-release configuration: N/A
• CI logs: N/A

[naffers]

We're currently running npm audit in our pipelines and as a result these vulnerabilities are causing a bit of a blocker for us.

As there hasn't been more noise on this I'm wondering slightly if there's a workaround to this that we're just not aware of?

[gr2m]

here is the output of npm audit on a fresh install

tmp.zAXzGUMT ➜ npm audit
# npm audit report

ansi-regex  >2.1.1 <5.0.1
Severity: moderate
 Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw
fix available via `npm audit fix`
node_modules/npm/node_modules/cli-table3/node_modules/ansi-regex
node_modules/npm/node_modules/string-width/node_modules/ansi-regex
  strip-ansi  4.0.0 - 5.2.0
  Depends on vulnerable versions of ansi-regex
  node_modules/npm/node_modules/string-width/node_modules/strip-ansi
    string-width  2.1.0 - 4.1.0
    Depends on vulnerable versions of strip-ansi
    node_modules/npm/node_modules/string-width

It looks like the problem is the npm dependency:

$ npm ls ansi-regex
tmp.zaxzgumt@1.0.0 /private/var/folders/hs/x9qtfmvn1lz1sgml9q21h7k80000gn/T/tmp.zAXzGUMT
└─┬ semantic-release@18.0.0
  ├─┬ @semantic-release/npm@8.0.1
  │ └─┬ npm@7.24.2
  │   ├─┬ cli-columns@3.1.2
  │   │ ├─┬ string-width@2.1.1
  │   │ │ └─┬ strip-ansi@4.0.0
  │   │ │   └── ansi-regex@3.0.0
  │   │ └─┬ strip-ansi@3.0.1
  │   │   └── ansi-regex@2.1.1
  │   └─┬ cli-table3@0.6.0
  │     └─┬ string-width@4.2.2
  │       └─┬ strip-ansi@6.0.0
  │         └── ansi-regex@5.0.0
  └─┬ yargs@16.2.0
    └─┬ cliui@7.0.4
      └─┬ strip-ansi@6.0.1
        └── ansi-regex@5.0.1

ansi-regex was bumped in strip-ansi in v6.0.1:
chalk/strip-ansi#40

strip-ansi was bumped in strip-width in https://github.com/sindresorhus/string-width/releases/tag/v4.2.3

cli-table3 0.6.0 defines dependency on strip-ansi as ^4.2.0:
https://unpkg.com/browse/cli-table3@0.6.0/package.json#L17

So I don't know why string-width 4.2.2 was installed instead of 4.2.3

That's as far as I can look into it. Hope that gives you some pointers. I'd check in with the npm team