Vulnerability reported due to optionator v0.9.1 transitive dependency

[padamstx]

Chore summary
The @stoplight/spectral-cli package has an indirect dependency on optionator v0.9.1, which has a vulnerability (CVE-2023-26115) due to its "word-wrap" dependency. Optionator v0.9.3 was recently released which fixes this by using a different "word-wrap" package.

The purpose of this issue is to request that spectral-cli be updated to avoid this CVE.

Tasks

• Upgrade dependencies so that optionator v0.9.3 is used in order to avoid CVE-2023-26115

Additional context
n/a

[Jokinen]

In our research, we noticed this kind of a dependency path for word-wrap.

@stoplight/[email protected]
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └─┬ [email protected]
            └── [email protected]

[P0lip]

Should be addressed by #2513 which drops proxy-agent

[padamstx]

Thanks for addressing this, @P0lip !

[stoplight-bot]

🎉 This issue has been resolved in version 6.9.0 🎉

The release is available on npm package (@latest dist-tag)

Your semantic-release bot 📦🚀