@ui5/cli 2.14.8 → 2.14.11

package/CHANGELOG.md

@@ -2,7 +2,22 @@
 All notable changes to this project will be documented in this file.  
 This project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
-A list of unreleased changes can be found [here](https://github.com/SAP/ui5-cli/compare/v2.14.8...HEAD).
+A list of unreleased changes can be found [here](https://github.com/SAP/ui5-cli/compare/v2.14.11...HEAD).
+
+<a name="v2.14.11"></a>
+## [v2.14.11] - 2022-09-05
+### Bug Fixes
+- Upgrade update-notifier to solve security vulnerabilities ([#533](https://github.com/SAP/ui5-cli/issues/533)) [`5b7cfcf`](https://github.com/SAP/ui5-cli/commit/5b7cfcf62c37492c4072c69f400512ef59aab502)
+
+
+<a name="v2.14.10"></a>
+## [v2.14.10] - 2022-07-25
+
+<a name="v2.14.9"></a>
+## [v2.14.9] - 2022-05-04
+### Dependency Updates
+- Bump [@ui5](https://github.com/ui5)/builder from 2.11.4 to 2.11.5 [`aa90039`](https://github.com/SAP/ui5-cli/commit/aa9003933bb6f5e71e9ce968ab5cc6202f805256)
+
 
 <a name="v2.14.8"></a>
 ## [v2.14.8] - 2022-04-14
@@ -729,6 +744,9 @@ Only Node.js v10 or higher is supported.
 <a name="v0.0.1"></a>
 ## v0.0.1 - 2018-06-06
 
+[v2.14.11]: https://github.com/SAP/ui5-cli/compare/v2.14.10...v2.14.11
+[v2.14.10]: https://github.com/SAP/ui5-cli/compare/v2.14.9...v2.14.10
+[v2.14.9]: https://github.com/SAP/ui5-cli/compare/v2.14.8...v2.14.9
 [v2.14.8]: https://github.com/SAP/ui5-cli/compare/v2.14.7...v2.14.8
 [v2.14.7]: https://github.com/SAP/ui5-cli/compare/v2.14.6...v2.14.7
 [v2.14.6]: https://github.com/SAP/ui5-cli/compare/v2.14.5...v2.14.6

package/bin/ui5.js

@@ -38,7 +38,7 @@ if (
 		console.log("=====================================================================");
 	}
 	// Timeout is required to log info when importing from local installation
-	setTimeout(() => {
+	setTimeout(async () => {
 		if (!process.env.UI5_CLI_NO_LOCAL) {
 			const importLocal = require("import-local");
 			// Prefer a local installation of @ui5/cli.
@@ -57,14 +57,26 @@ if (
 			}
 		}
 
-		const updateNotifier = require("update-notifier");
-		updateNotifier({
-			pkg,
-			updateCheckInterval: 1000 * 60 * 60 * 24, // 1 day
-			shouldNotifyInNpmScript: true
-		}).notify();
-		// Remove --no-update-notifier from argv as it's not known to yargs, but we still want to support using it
+		// Only import update-notifier when it's not disabled
+		// See https://github.com/yeoman/update-notifier/blob/3046d0f61a57f8270291b6ab271f8a12df8421a6/update-notifier.js#L57-L60
+		// The "is-ci" check is not executed, but will be checked by update-notifier itself then
 		const NO_UPDATE_NOTIFIER = "--no-update-notifier";
+		const disableUpdateNotifier =
+			"NO_UPDATE_NOTIFIER" in process.env ||
+			process.env.NODE_ENV === "test" ||
+			process.argv.includes(NO_UPDATE_NOTIFIER);
+
+		// Update notifier requires dynamic imports (ES Module) and therefore is loaded via a separate file
+		if (
+			!disableUpdateNotifier &&
+
+			// Node.js versions supporting ES modules
+			semver.satisfies(nodeVersion, "^12.20 || ^14.14 || >= 16.0", {includePrerelease: true})
+		) {
+			const updateNotifier = require("../lib/cli/update-notifier");
+			await updateNotifier({pkg});
+		}
+		// Remove --no-update-notifier from argv as it's not known to yargs, but we still want to support using it
 		if (process.argv.includes(NO_UPDATE_NOTIFIER)) {
 			process.argv = process.argv.filter((v) => v !== NO_UPDATE_NOTIFIER);
 		}

package/lib/cli/update-notifier.js

@@ -0,0 +1,12 @@
+// update-notifier is an ES module and therefore needs to be loaded via "import".
+// It is important to have this code in a separate file as this module also
+// supports Node.js versions without dynamic import support (e.g. v10).
+// Otherwise it will lead to syntax errors.
+module.exports = async function({pkg}) {
+	const updateNotifier = (await import("update-notifier")).default;
+	updateNotifier({
+		pkg,
+		updateCheckInterval: 1000 * 60 * 60 * 24, // 1 day
+		shouldNotifyInNpmScript: true
+	}).notify();
+};