[Snyk] Upgrade yargs from 17.7.2 to 18.0.0

[snyk-io]

Snyk has created this PR to upgrade yargs from 17.7.2 to 18.0.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 11 versions ahead of your current version.

• The recommended version was released 5 months ago.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

Issues fixed by the recommended upgrade:

	Issue	Score	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-CROSSSPAWN-8303230	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	57	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-BRACEEXPANSION-9789073	57	Proof of Concept

Release notes

Package name: yargs

• 18.0.0 - 2025-05-27
  

  18.0.0 (2025-05-26)

  ⚠ BREAKING CHANGES

  • command names are not derived from modules passed to command.
  • singleton usage of yargs yargs.foo, yargs().argv, has been removed.
  • minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23.
  • yargs is now ESM first

  Features

  • commandDir now works with ESM files (#2461) (27eec18)
  • locale: adds hebrew translation (#2357) (4266485)
  • yargs is now ESM first (d90af45)
  • zsh: Add default completion as fallback (#2331) (e02c91b)

  Bug Fixes

  • addDirectory do not support absolute command dir (#2465) (3a40a78)
  • allows ESM modules commands to be extensible using visit option (#2468) (200e1aa)
  • browser: fix shims so that yargs continues working in browser context (#2457) (4ae5f57)
  • build: address problems with typescript compilation (#2445) (8d72fb3)
  • coerce should play well with parser configuration (#2308) (8343c66)
  • deps: update dependency yargs-parser to v22 (#2470) (639130d)
  • exit after async handler done (#2313) (e326cde)
  • handle spaces in bash completion (#2452) (83b7788)
  • parser-configuration should work well with generated completion script (#2332) (888db19)
  • propagate Dictionary including undefined in value type (#2393) (2b2f7f5)
  • zsh: completion no longer requires double tab when using autoloaded (0dd8fe4)

  Code Refactoring

  • command names are not derived from modules passed to command. (d90af45)
  • singleton usage of yargs yargs.foo, yargs().argv, has been removed. (d90af45)

  Build System

  • minimum node.js versions now ^20.19.0 || ^22.12.0 || >=23. (d90af45)
• 18.0.0-candidate.7 - 2025-04-25
• 18.0.0-candidate.6 - 2025-04-24
• 18.0.0-candidate.5 - 2025-04-23
• 18.0.0-candidate.4 - 2025-04-16
• 18.0.0-candidate.3 - 2025-04-11
• 18.0.0-candidate.2 - 2025-04-10
• 18.0.0-candidate.1 - 2025-04-09
• 18.0.0-browser.2 - 2025-04-11
• 18.0.0-browser.1 - 2025-04-11
• 18.0.0-browser.0 - 2025-04-10
• 17.7.2 - 2023-04-27
  

  17.7.2 (2023-04-27)

  Bug Fixes

  • do not crash completion when having negated options (#2322) (7f42848)

from yargs GitHub release notes

---

Important

• Warning: This PR contains a major version upgrade, and may be a breaking change.
• Check the changes in this PR to ensure they won't cause issues with your project.
• This PR was automatically created by Snyk using the credentials of a real user.
• Max score is 1000. Note that the real score may have changed since the PR was raised.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

• 🧐 View latest project report
• 📜 Customise PR templates
• 🛠 Adjust upgrade PR settings
• 🔕 Ignore this dependency or unsubscribe from future upgrade PRs

[semanticdiff-com]

Review changes with  

Changed Files

File	Status
package.json	0% smaller

[snyk-io]

⚠️ Snyk checks are incomplete.

Status	Scanner	Critical	High	Medium	Low	Total (0)
⚠️	Open Source Security	0	0	0	0	See details

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.