security fix support statement of cobra

[lichunl]

We used Cobra in our project. We'd like to have your support statement of Cobra for its security vulnerability fix. How frequency you will publish security vulnerability fix if there are any?

[elfahxh]

When I also use the opensource scan tool, https://github.com/jeremylong/DependencyCheck, to scan the dependencies of my project, and there are many CVEs found in indirect dependencies, as attached:

OpenSourceScan_cobra.xlsx

[elfahxh]

After replace the dependency package github.com/spf13/viper to higher version, most of CVEs can be resolved, It looks like that most of CVEs caused by viper package:

replace github.com/spf13/viper v1.7.0 => github.com/spf13/viper v1.8.0