@ui5/cli 2.14.10 → 2.14.12

package/CHANGELOG.md

@@ -2,10 +2,22 @@
 All notable changes to this project will be documented in this file.  
 This project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
-A list of unreleased changes can be found [here](https://github.com/SAP/ui5-cli/compare/v2.14.10...HEAD).
+A list of unreleased changes can be found [here](https://github.com/SAP/ui5-cli/compare/v2.14.12...HEAD).
+
+<a name="v2.14.12"></a>
+## [v2.14.12] - 2022-10-12
+### Dependency Updates
+- Bump [@ui5](https://github.com/ui5)/builder from 2.11.5 to 2.11.6 [`f695e27`](https://github.com/SAP/ui5-cli/commit/f695e2733395599271b1a1059860c519851c7fe7)
+
+
+<a name="v2.14.11"></a>
+## [v2.14.11] - 2022-09-05
+### Bug Fixes
+- Upgrade update-notifier to solve security vulnerabilities ([#533](https://github.com/SAP/ui5-cli/issues/533)) [`5b7cfcf`](https://github.com/SAP/ui5-cli/commit/5b7cfcf62c37492c4072c69f400512ef59aab502)
+
 
 <a name="v2.14.10"></a>
-## [v2.14.10] - 2022-07-24
+## [v2.14.10] - 2022-07-25
 
 <a name="v2.14.9"></a>
 ## [v2.14.9] - 2022-05-04
@@ -738,6 +750,8 @@ Only Node.js v10 or higher is supported.
 <a name="v0.0.1"></a>
 ## v0.0.1 - 2018-06-06
 
+[v2.14.12]: https://github.com/SAP/ui5-cli/compare/v2.14.11...v2.14.12
+[v2.14.11]: https://github.com/SAP/ui5-cli/compare/v2.14.10...v2.14.11
 [v2.14.10]: https://github.com/SAP/ui5-cli/compare/v2.14.9...v2.14.10
 [v2.14.9]: https://github.com/SAP/ui5-cli/compare/v2.14.8...v2.14.9
 [v2.14.8]: https://github.com/SAP/ui5-cli/compare/v2.14.7...v2.14.8

package/bin/ui5.js

@@ -38,7 +38,7 @@ if (
 		console.log("=====================================================================");
 	}
 	// Timeout is required to log info when importing from local installation
-	setTimeout(() => {
+	setTimeout(async () => {
 		if (!process.env.UI5_CLI_NO_LOCAL) {
 			const importLocal = require("import-local");
 			// Prefer a local installation of @ui5/cli.
@@ -57,14 +57,26 @@ if (
 			}
 		}
 
-		const updateNotifier = require("update-notifier");
-		updateNotifier({
-			pkg,
-			updateCheckInterval: 1000 * 60 * 60 * 24, // 1 day
-			shouldNotifyInNpmScript: true
-		}).notify();
-		// Remove --no-update-notifier from argv as it's not known to yargs, but we still want to support using it
+		// Only import update-notifier when it's not disabled
+		// See https://github.com/yeoman/update-notifier/blob/3046d0f61a57f8270291b6ab271f8a12df8421a6/update-notifier.js#L57-L60
+		// The "is-ci" check is not executed, but will be checked by update-notifier itself then
 		const NO_UPDATE_NOTIFIER = "--no-update-notifier";
+		const disableUpdateNotifier =
+			"NO_UPDATE_NOTIFIER" in process.env ||
+			process.env.NODE_ENV === "test" ||
+			process.argv.includes(NO_UPDATE_NOTIFIER);
+
+		// Update notifier requires dynamic imports (ES Module) and therefore is loaded via a separate file
+		if (
+			!disableUpdateNotifier &&
+
+			// Node.js versions supporting ES modules
+			semver.satisfies(nodeVersion, "^12.20 || ^14.14 || >= 16.0", {includePrerelease: true})
+		) {
+			const updateNotifier = require("../lib/cli/update-notifier");
+			await updateNotifier({pkg});
+		}
+		// Remove --no-update-notifier from argv as it's not known to yargs, but we still want to support using it
 		if (process.argv.includes(NO_UPDATE_NOTIFIER)) {
 			process.argv = process.argv.filter((v) => v !== NO_UPDATE_NOTIFIER);
 		}

package/lib/cli/update-notifier.js

@@ -0,0 +1,12 @@
+// update-notifier is an ES module and therefore needs to be loaded via "import".
+// It is important to have this code in a separate file as this module also
+// supports Node.js versions without dynamic import support (e.g. v10).
+// Otherwise it will lead to syntax errors.
+module.exports = async function({pkg}) {
+	const updateNotifier = (await import("update-notifier")).default;
+	updateNotifier({
+		pkg,
+		updateCheckInterval: 1000 * 60 * 60 * 24, // 1 day
+		shouldNotifyInNpmScript: true
+	}).notify();
+};