fix: solve dependency security issues

[byCedric]

Description

This is a dependency security upgrade, complementary to #473.

Motivation and Context

I did a manual security audit, with npm audit, and found 2 issues. While one of them isn't included in any commitlint package, I think it's best to still upgrade because of the security level (critical). The other issue is a minor one, also related to old Lodash, through commitizen.

root package

This one is related to docsify-cli using the insecure open library, this has been patched and refactored by opn. This change is done here.

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Critical      │ Command Injection                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ open                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ docsify-cli [dev]                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ docsify-cli > open                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/663                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

@commitlint/prompt

There were 3 issues, 2 of them easily fixable by upgrading a package (commitizen). The first two are, like said before, lodash issues through the use of another dependency. I've checked the major patch of commitlint, the only big change is the dropped support for Node <6. Luckily, commitlint doesn't support lower than 6 either, so that should be compatible.

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ commitizen [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ commitizen > lodash                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ commitizen [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ commitizen > inquirer > lodash                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

The other issue is related to Vorpal (and lodash again), but there is no fix (yet). Some discussion is taking place here.

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ vorpal                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ vorpal > inquirer > lodash                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/577                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Usage examples

How Has This Been Tested?

It might be best to search for an automatic and continuous security check.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have added tests to cover my changes.
• All new and existing tests passed.