CVE-2022-33987

[danepowell]

This package should update its dependency on latest-version to at least v6.0.0 to fix a downstream vulnerability in got. See remy/nodemon#2023 for details.

[erunion]

@sindresorhus Can you update latest-version in the 5.x tag series as well? There are a lot of packages out here that are using it and can't just upgrade to ESM.

[ryanblock]

Since ensuring the safety and security of developers who cannot change to ESM has not been a priority for this project, I've created a fork here: https://www.npmjs.com/package/update-notifier-cjs

No meaningful logic changes have occurred to this library since making the change to ESM; this forked version is just 5.x, but with with two other Sindre dependencies vendored so as to enable making use of the got patch that addresses CVE-2022-33987.