Vulnerability in yargs-parser 16.1.0 used in core and plugin-core-support

[mark-nc]

Describe the bug
@kui-shell/core and @kui-shell/plugin-core-support both list yargs-parser v16.1.0 as a dependency.

This report describes a vulnerability in that version (see https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381). The vulnerability found shows that yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

This vulnerability is fixed in these versions

• yargs-parser 13.1.2
• yargs-parser 15.0.1
• yargs-parser 18.1.1 or higher

@kui-shell/core and @kui-shell/plugin-core-support should be updated to use version 18.1.1 or higher.

System

• Kui version: 8.x
• Operating system: any

[starpit]

weird npm bug? the prior PR indeed bumped the yargs-parser version to the desired 18.1.3, and it also indeed updated pafckage-lock.json... but for some reason npm ci still installed the old verison. worse, if one issued an npm install, one would get errors saying can't find yargs-parser. so weird.