[Snyk] Security upgrade del from 3.0.0 to 8.0.0

[Exnadella]

User description

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • packages/cli/package.json
  • packages/cli/package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Priority Score (*)	Issue	Breaking Change	Exploit Maturity
	631/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 6.2	Missing Release of Resource after Effective Lifetime SNYK-JS-INFLIGHT-6095116	Yes	Proof of Concept
	479/1000 Why? Has a fix available, CVSS 5.3	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	Yes	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Commit messages

Package name: del

The new version differs by 55 commits.

• 51344d2 8.0.0
• 7778d71 Meta tweaks
• e2e5b71 Require Node.js 18 and update dependencies ([Snyk] Security upgrade rollup from 0.64.1 to 3.29.5 #161)
• 7df7949 7.1.0
• f5d31e6 Add `path` to `onProgress` event ([Snyk] Security upgrade express from 4.17.1 to 4.21.0 #155)
• e9b0d71 Fix CI
• 9e17de8 Document `dot` option ([Snyk] Fix for 5 vulnerabilities #148)
• 5345ef6 7.0.0
• e02a96b Meta tweaks
• 106d7d8 Move to ESM ([Snyk] Security upgrade @octokit/rest from 14.0.9 to 16.0.0 #143)
• 5de56fd 6.1.1
• 7b4c881 Fix `ProgressData#deletedCount` ([Snyk] Fix for 14 vulnerabilities #142)
• c12fddd 6.1.0
• 8742649 Add `onProgress` option ([Snyk] Security upgrade winston from 3.2.1 to 3.3.4 #141)
• 7c756b3 Rename `master` branch to `main`
• d0030ba Move to GitHub Actions ([Snyk] Security upgrade vinyl-fs from 2.4.4 to 4.0.0 #131)
• 72007d7 Fix readme typo ([Snyk] Security upgrade glob from 7.1.4 to 9.0.0 #129)
• cd0543e 6.0.0
• 6c99805 Require Node.js 10
• 1df5280 Readme tweaks
• 4acd962 Add tip about deleting subdirectories ([Snyk] Upgrade command-line-usage from 5.0.5 to 7.0.1 #116)
• 1a0c36c Add mention of GitHub Sponsors
• 1e0d705 Tidelift tasks
• 892ce2a Make it clear that it recursively deletes directories ([Snyk] Upgrade @types/fs-extra from 5.1.0 to 11.0.4 #113)

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

---

PR Type

enhancement, dependencies

---

Description

• Upgraded del package from version 3.0.0 to 8.0.0 in both package.json and package-lock.json to address vulnerabilities.
• Added new dependencies such as @nodelib/fs.scandir, @nodelib/fs.walk, and fast-glob to support the updated del package.
• Updated several existing dependencies to newer versions to enhance security and functionality.
• Introduced optional and devOptional dependencies for better package management.

---

Changes walkthrough 📝

Relevant files

Dependencies

package-lock.json Upgrade dependencies and enhance package-lock.json              packages/cli/package-lock.json Upgraded del package from version 3.0.0 to 8.0.0. Added new dependencies such as @nodelib/fs.scandir, @nodelib/fs.walk, and fast-glob. Updated several existing dependencies to newer versions. Introduced optional and devOptional dependencies for better package management. +214/-64 package.json Upgrade del package to address vulnerabilities                      packages/cli/package.json Upgraded del package from version 3.0.0 to 8.0.0. +1/-1

---

💡 PR-Agent usage: Comment /help "your question" on any pull request to receive relevant information

[codiumai-pr-agent-pro]

PR Reviewer Guide 🔍

Here are some key observations to aid the review process:

🎫 Ticket compliance analysis ✅ 161 - Fully compliant Fully compliant requirements: Upgrade rollup from 0.64.1 to 3.29.5

⏱️ Estimated effort to review: 1 🔵⚪⚪⚪⚪

🧪 No relevant tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Dependency Update Verify that the upgrade of del from 3.0.0 to 8.0.0 doesn't introduce any breaking changes or compatibility issues with existing code.

[codiumai-pr-agent-pro]

PR Code Suggestions ✨

Explore these optional code suggestions:

Category	Suggestion	Score
Enhancement	Update other dependencies to their latest compatible versions for consistency and potential improvements Consider updating other dependencies to their latest compatible versions to ensure consistency and potentially benefit from bug fixes and new features. packages/cli/package.json [59-61] "del": "^8.0.0", -"findup-sync": "^0.4.2", -"globby": "^8.0.1", +"findup-sync": "^4.0.0", +"globby": "^11.1.0", Apply this suggestion Suggestion importance[1-10]: 5 Why: The suggestion to update other dependencies to their latest versions could improve consistency and potentially bring bug fixes and new features. However, it requires careful consideration of compatibility and testing, which is not addressed in the suggestion.	5
Best practice	Review newly added dependencies for necessity and potential conflicts Review and potentially update the newly added dependencies (@nodelib/fs.scandir, @nodelib/fs.walk, fast-glob, etc.) to ensure they are necessary and don't introduce any conflicts or vulnerabilities. packages/cli/package-lock.json [666-681] +// After thorough review and testing "@nodelib/fs.scandir": { "version": "2.1.5", "resolved": "https://registry.npmjs.org/@nodelib/fs.scandir/-/fs.scandir-2.1.5.tgz", "integrity": "sha512-vq24Bq3ym5HEQm2NKCr3yXDwjc7vTsEThRDnkp2DK9p1uqLR+DHurm/NOTo0KG7HYHU7eppKZj3MyqYuMBf62g==", "requires": { "@nodelib/fs.stat": "2.0.5", "run-parallel": "^1.1.9" }, Apply this suggestion Suggestion importance[1-10]: 4 Why: The suggestion to review newly added dependencies for necessity and potential conflicts is a good practice but is not actionable by itself. It lacks specific guidance or changes, thus having a limited direct impact on the code.	4

💡 Need additional feedback ? start a PR chat