[Bug Report]: inquirer (CLI dep) - 4 vulnerabilities reported by NPM

[jarrodek]

Steps to reproduce

Install @farmfe/cli

npm i @farmfe/cli

Reproduce link

No response

What is actually happening?

$ npm audit 
# npm audit report

tmp  <=0.2.5
Severity: high
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6
tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape - https://github.com/advisories/GHSA-ph9p-34f9-6g65
fix available via `npm audit fix --force`
Will install @farmfe/cli@1.0.2, which is a breaking change
node_modules/tmp
  external-editor  >=1.1.1
  Depends on vulnerable versions of tmp
  node_modules/external-editor
    inquirer  3.0.0 - 8.2.6 || 9.0.0 - 9.3.7
    Depends on vulnerable versions of external-editor
    node_modules/inquirer
      @farmfe/cli  1.0.3 - 1.0.5
      Depends on vulnerable versions of inquirer
      node_modules/@farmfe/cli

4 vulnerabilities (3 low, 1 high)

To address all issues (including breaking changes), run:
  npm audit fix --force

System Info

System:
    OS: Linux 7.0 Ubuntu 26.04 LTS 26.04 LTS (Resolute Raccoon)
    CPU: (28) x64 Intel(R) Core(TM) i9-10940X CPU @ 3.30GHz
    Memory: 100.69 GB / 107.47 GB
    Container: Yes
    Shell: 5.3.9 - /bin/bash
  Browsers:
    Chrome: 150.0.7865.2
  npmPackages:
    @farmfe/core: ^1.6.7 => 1.7.11 
    @farmfe/cli: ^1.0.4 => 1.0.5

[wre232114]

Looking into it, thank you