From fac99093f68d77c31a4a220e7263989dc577ead6 Mon Sep 17 00:00:00 2001 From: casalino Date: Fri, 15 May 2026 14:49:20 -0400 Subject: [PATCH] fix: upgrade yeoman-environment to v6 to resolve tar CVEs MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Upgrades yeoman-environment from ^4.2.1 to ^6.1.0. The v4 dependency chain pulled in tar <=7.5.10 (via fly-import → @npmcli/arborist → cacache), which carried 6 high-severity CVEs. v6 resolves to tar 7.5.15 through an updated arborist/cacache chain, eliminating all findings. Co-Authored-By: Claude Sonnet 4.6 --- package.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package.json b/package.json index 21720ae..f7cf25c 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "inquirer": "^8.2.4", "js-yaml": "^3.14.1", "ora": "^4.1.1", - "yeoman-environment": "^4.2.1" + "yeoman-environment": "^6.1.0" }, "devDependencies": { "@adobe/eslint-config-aio-lib-config": "5.0.0",