Possibility of switching to update-notifier v6?

[MatthewClark2]

update-notifier@5.1.0 has a dependency on a vulnerable version of got. As per npm audit:

got  <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install update-notifier@6.0.2, which is a breaking change
node_modules/package-json/node_modules/got
  package-json  <=6.5.0
  Depends on vulnerable versions of got
  node_modules/package-json
    latest-version  0.2.0 - 5.1.0
    Depends on vulnerable versions of package-json
    node_modules/latest-version
      update-notifier  0.2.0 - 5.1.0
      Depends on vulnerable versions of latest-version
      node_modules/update-notifier

Fixing this warning seems like it would be non-trivial as update-notifier >= 6.0.0 requires ESM. Are there any plans to make the update?

[hassy]

hi @MatthewClark2 👋

Is this blocking the use of Artillery for you? (I know that some teams have hard gates for anything that gets flagged up by npm audit / Snyk)

We do plan on moving to ESM as more and more of our dependencies become ESM-only but don't have a definitive target date to complete the transition yet.