inquirer@1 pulls vulnerable tmp@0.0.29 (npm audit high)

[stein2nd]

Context

editorconfig-cli@1.0.0 (npm latest) depends on inquirer@^1.2.3. Installing a package that depends on editorconfig-cli with npm 12 surfaces a high-severity npm audit finding on tmp, via that old Inquirer stack.

This repo is the GitHub home of the npm package (R1ZZU/editorconfig-cli redirects here).

What we see

editorconfig-cli@1.0.0
└─┬ inquirer@1.2.3
  └─┬ external-editor@1.1.1
    └── tmp@0.0.29

npm audit reports tmp@<=0.2.5 as high (symlink dir write / prefix path traversal: GHSA-52f5-9888-hmc6, GHSA-ph9p-34f9-6g65). external-editor@>=1.1.1 is marked as affected because it depends on that tmp.

inquirer@1.2.3 itself is from 2016. commander@^2.8.1 and editorconfig@^0.13.0 on the same package are also far behind current majors, but the audit hit is specifically tmp.

Desired resolution

1. Preferred: move prompts to current Inquirer (inquirer@^12 / @inquirer/prompts). That line no longer depends on the old tmp / external-editor@1 stack. It is ESM, so this likely means "type": "module" (or a small compile step) and updating require('inquirer') in lib/actions/init.js and lib/actions/add-rules.js.
2. Interim (keep CommonJS): bump to inquirer@^8.2.7. v8 is the last CJS-friendly major; 8.2.7 uses @inquirer/external-editor instead of external-editor@1 → tmp@0.0.29. Please confirm npm audit is clean after the bump.
3. Publish a new 1.0.1 / 1.1.0 to npm so latest is not the current tarball.

ncu cannot bump this from the consumer side: editorconfig-cli has had no newer release since 1.0.0.

Happy to test ec init / ec add-rules against a pre-release.