[agent] chore(deps): bump yargs-parser to >=5.0.1 via npm overrides

[github-actions]

Summary

Addresses Dependabot alert #18: GHSA-p9pc-299p-vxgp / CVE-2020-7608 — yargs-parser Vulnerable to Prototype Pollution (CVSS 5.3 medium).

Root cause

yargs-parser@2.4.1 (vulnerable range: <= 5.0.0) was installed as a transitive dependency via:

packages/mongodb-cloud-info (devDependency)
  └── gce-ips@1.0.2
        └── yargs@^4.7.0
              └── yargs-parser@^2.4.1  ← vulnerable

Why overrides was used

The gce-ips package is stuck at version 1.0.2 (the only published version) and has not shipped a release with an updated yargs dependency. Since the direct dependency maintainer has not published a fix, a targeted npm overrides entry was added per policy.

Changes

• package.json: Added "overrides": { "gce-ips>yargs>yargs-parser": ">=5.0.1" } to force the patched version.
• package-lock.json: Updated the nested node_modules/gce-ips/node_modules/yargs-parser entry from 2.4.1 to 5.0.1 (and updated its dependencies from lodash.assign to object.assign, as changed in 5.x).

Impact assessment

gce-ips is a dev-only dependency used in the update-cidrs.ts script. Crucially, gce-ips/index.js does not import yargs — yargs is only used in the CLI binary (bin/gce-ips.js). The update-cidrs.ts script imports gce-ips as a module, so there is no runtime impact from overriding yargs-parser in this chain.

Generated by Dependabot remediation agent · ● 1.5M · ◷