Skip to content

[Snyk] Upgrade commander from 1.0.0 to 14.0.0#7

Open
SherfeyInv wants to merge 1 commit intomasterfrom
snyk-upgrade-6654650874738618b6c419cc704fdcfa
Open

[Snyk] Upgrade commander from 1.0.0 to 14.0.0#7
SherfeyInv wants to merge 1 commit intomasterfrom
snyk-upgrade-6654650874738618b6c419cc704fdcfa

Conversation

@SherfeyInv
Copy link

@SherfeyInv SherfeyInv commented Aug 25, 2025

snyk-top-banner

Snyk has created this PR to upgrade commander from 1.0.0 to 14.0.0.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

⚠️ Warning: This PR contains major version upgrade(s), and may be a breaking change.

  • The recommended version is 98 versions ahead of your current version.

  • The recommended version was released 3 months ago.

Release notes
Package name: commander
  • 14.0.0 - 2025-05-18

    Added

    • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher
      -level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following option
      s/commands (#2328)
    • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
    • TypeScript: add parseArg property to Argument class (#2359)

    Fixed

    • remove bogus leading space in help when option has default value but not a description (#2348)
    • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

    Changed

    • Breaking: Commander 14 requires Node.js v20 or higher
    • internal refactor of Help class adding .formatItemList() and .groupItems() methods (#2328)
  • 13.1.0 - 2025-01-20

    Added

    • support a pair of long option flags to allow a memorable shortened flag, like .option('--ws, --workspace') (#2312)
  • 13.0.0 - 2024-12-30

    Added

    • support multiple calls to .parse() with default settings (#2299)
    • add .saveStateBeforeParse() and .restoreStateBeforeParse() for use by subclasses (#2299)
    • style routines like styleTitle() to add color to help using .configureHelp() or Help subclass (#2251)
    • color related support in .configureOutput() for getOutHasColors(), getErrHasColors(), and stripColor() (#2251)
    • Help property for minWidthToWrap (#2251)
    • Help methods for displayWidth(), boxWrap(), preformatted() et al (#2251)

    Changed

    • Breaking: excess command-arguments cause an error by default, see migration tips (#2223)
    • Breaking: throw during Option construction for unsupported option flags, like multiple characters after single - (#2270)
    • Breaking: throw on multiple calls to .parse() if storeOptionsAsProperties: true (#2299)
    • TypeScript: include implicit this in parameters for action handler callback (#2197)

    Deleted

    • Breaking: Help.wrap() refactored into formatItem() and boxWrap() (#2251)

    Migration Tips

    Excess command-arguments

    It is now an error for the user to specify more command-arguments than are expected. (allowExcessArguments is now false by default.)

    Old code:

    program.option('-p, --port <number>', 'port number');
program.action((options) => {
  console.log(program.args);
});

    Now shows an error:

    $ node example.js a b c
error: too many arguments. Expected 0 arguments but got 3.

    You can declare the expected arguments. The help will then be more accurate too. Note that declaring
    new arguments will change what is passed to the action handler.

    program.option('-p, --port <number>', 'port number');
program.argument('[args...]', 'remote command and arguments'); // expecting zero or more arguments
program.action((args, options) => {
  console.log(args);
});

    Or you could suppress the error, useful for minimising changes in legacy code.

    program.option('-p, --port', 'port number');
program.allowExcessArguments();
program.action((options) => {
  console.log(program.args);
});
  • 13.0.0-0 - 2024-12-06

    Added

    • style routines like styleTitle() to add color to help using .configureHelp() or Help subclass (#2251)
    • color related support in .configureOutput() for getOutHasColors(), getErrHasColors(), and stripColor() (#2251)
    • Help property for minWidthToWrap (#2251)
    • Help methods for displayWidth(), boxWrap(), preformatted() et al (#2251)

    Changed

    • Breaking: excess command-arguments cause an error by default, see migration tips (#2223)
    • Breaking: throw during Option construction for unsupported option flags, like multiple characters after single - (#2270)
    • TypeScript: include implicit this in parameters for action handler callback (#2197)

    Deleted

    • Breaking: Help.wrap() refactored into formatItem() and boxWrap() (#2251)

    Migration Tips

    Excess command-arguments

    It is now an error for the user to specify more command-arguments than are expected. (allowExcessArguments is now false by default.)

    Old code:

    program.option('-p, --port <number>', 'port number');
program.action((options) => {
  console.log(program.args);
});

    Now shows an error:

    $ node example.js a b c
error: too many arguments. Expected 0 arguments but got 3.

    You can declare the expected arguments. The help will then be more accurate too. Note that declaring
    new arguments will change what is passed to the action handler.

    program.option('-p, --port <number>', 'port number');
program.argument('[args...]', 'remote command and arguments'); // expecting zero or more arguments
program.action((args, options) => {
  console.log(args);
});

    Or you could suppress the error, useful for minimising changes in legacy code.

    program.option('-p, --port', 'port number');
program.allowExcessArguments();
program.action((options) => {
  console.log(program.args);
});
  • 12.1.0 - 2024-05-18

    Added

    • auto-detect special node flags node --eval and node --print when call .parse() with no arguments (#2164)

    Changed

    • prefix require of Node.js core modules with node: (#2170)
    • format source files with Prettier (#2180)
    • switch from StandardJS to directly calling ESLint for linting (#2153)
    • extend security support for previous major version of Commander (#2150)

    Removed

    • removed unimplemented Option.fullDescription from TypeScript definition (#2191)
  • 12.0.0 - 2024-02-03

    Added

    • .addHelpOption() as another way of configuring built-in help option (#2006)
    • .helpCommand() for configuring built-in help command (#2087)

    Fixed

    • Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
    • Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)

    Changed

    • Breaking: Commander 12 requires Node.js v18 or higher (#2027)
    • Breaking: throw an error if add an option with a flag which is already in use (#2055)
    • Breaking: throw an error if add a command with name or alias which is already in use (#2059)
    • Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
    • replace non-standard JSDoc of @ api private with documented @ private (#1949)
    • .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
    • refactor internal implementation of built-in help option (#2006)
    • refactor internal implementation of built-in help command (#2087)

    Deprecated

    • .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)

    Removed

    • Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)

    Migration Tips

    global program

    If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).

    // const program = require('commander');
const { program } = require('commander');

    option and command clashes

    A couple of configuration problems now throw an error, which will pick up issues in existing programs:

    • adding an option which uses the same flag as a previous option
    • adding a command which uses the same name or alias as a previous command
  • 12.0.0-1 - 2024-01-19

    Added

    • .addHelpOption() as another way of configuring built-in help option (#2006)
    • .helpCommand() for configuring built-in help command (#2087)

    Changed

    • .addHelpCommand() now takes a Command (passing string or boolean still works as before but deprecated) (#2087)
    • refactor internal implementation of built-in help option (#2006)
    • refactor internal implementation of built-in help command (#2087)

    Deprecated

    • .addHelpCommand() passing string or boolean (use .helpCommand() or pass a Command) (#2087)
  • 12.0.0-0 - 2023-11-11

    Fixed

    • Breaking: use non-zero exit code when spawned executable subcommand terminates due to a signal (#2023)
    • Breaking: check passThroughOptions constraints when using .addCommand and throw if parent command does not have .enablePositionalOptions() enabled (#1937)

    Changed

    • Breaking: Commander 12 requires Node.js v18 or higher (#2027)
    • Breaking: throw an error if add an option with a flag which is already in use (#2055)
    • Breaking: throw an error if add a command with name or alias which is already in use (#2059)
    • Breaking: throw error when calling .storeOptionsAsProperties() after setting an option value (#1928)
    • replace non-standard JSDoc of @ api private with documented @ private (#1949)

    Removed

    • Breaking: removed default export of a global Command instance from CommonJS (use the named program export instead) (#2017)

    Migration Tips

    global program

    If you are using the deprecated default import of the global Command object, you need to switch to using a named import (or create a new Command).

    // const program = require('commander');
const { program } = require('commander');

    option and command clashes

    A couple of configuration problems now throw an error, which will pick up issues in existing programs:

    • adding an option which uses the same flag as a previous option
    • adding a command which uses the same name or alias as a previous command
  • 11.1.0 - 2023-10-13

    Fixed

    • TypeScript: update OptionValueSource to allow any string, to match supported use of custom sources (#1983)
    • TypeScript: add that Command.version() can also be used as getter (#1982)
    • TypeScript: add null return type to Commands.executableDir(), for when not configured (#1965)
    • subcommands with an executable handler and only a short help flag are now handled correctly by the parent's help command (#1930)

    Added

    • registeredArguments property on Command with the array of defined Argument (like Command.options for Option) (#2010)
    • TypeScript declarations for Option properties: envVar, presetArg (#2019)
    • TypeScript declarations for Argument properties: argChoices, defaultValue, defaultValueDescription (#2019)
    • example file which shows how to configure help to display any custom usage in the list of subcommands (#1896)

    Changed

    • (developer) refactor TypeScript configs for multiple use-cases, and enable checks in JavaScript files in supporting editors (#1969)

    Deprecated

    • Command._args was private anyway, but now available as registeredArguments (#2010)
  • 11.0.0 - 2023-06-16

    Fixed

    • help command works when help option is disabled (#1864)

    Changed

    • leading and trailing spaces are now ignored by the .arguments() method (#1874)
    • refine "types" exports for ESM to follow TypeScript guidelines (#1886)
    • Breaking: Commander 11 requires Node.js v16 or higher
  • 10.0.1 - 2023-04-15
  • 10.0.0 - 2023-01-14
  • 9.5.0 - 2023-01-07
  • 9.4.1 - 2022-09-30
  • 9.4.0 - 2022-07-15
  • 9.3.0 - 2022-05-28
  • 9.2.0 - 2022-04-15
  • 9.1.0 - 2022-03-18
  • 9.0.0 - 2022-01-29
  • 9.0.0-1 - 2022-01-14
  • 9.0.0-0 - 2021-12-22
  • 8.3.0 - 2021-10-22
  • 8.2.0 - 2021-09-10
  • 8.1.0 - 2021-07-27
  • 8.0.0 - 2021-06-25
  • 8.0.0-2 - 2021-06-06
  • 8.0.0-1 - 2021-05-31
  • 8.0.0-0 - 2021-05-22
  • 7.2.0 - 2021-03-21
  • 7.1.0 - 2021-02-15
  • 7.0.0 - 2021-01-15
  • 7.0.0-2 - 2020-12-14
  • 7.0.0-1 - 2020-11-21
  • 7.0.0-0 - 2020-10-25
  • 6.2.1 - 2020-12-14
  • 6.2.0 - 2020-10-25
  • 6.1.0 - 2020-08-28
  • 6.0.0 - 2020-07-19
  • 6.0.0-0 - 2020-06-20
  • 5.1.0 - 2020-04-25
  • 5.0.0 - 2020-03-14
  • 5.0.0-4 - 2020-03-03
  • 5.0.0-3 - 2020-02-20
  • 5.0.0-2 - 2020-02-11
  • 5.0.0-1 - 2020-02-08
  • 5.0.0-0 - 2020-02-01
  • 4.1.1 - 2020-02-03
  • 4.1.0 - 2020-01-06
  • 4.0.1 - 2019-11-11
  • 4.0.0 - 2019-11-01

    Added

    • support for groups of options and commands in the help using low-level .helpGroup() on Option and Command, and higher
      -level .optionsGroup() and .commandsGroup() which can be used in chaining way to specify group title for following option
      s/commands (#2328)
    • support for unescaped negative numbers as option-arguments and command-arguments (#2339)
    • TypeScript: add parseArg property to Argument class (#2359)

    Fixed

    • remove bogus leading space in help when option has default value but not a description (#2348)
    • .configureOutput() now makes copy of settings instead of modifying in-place, fixing side-effects (#2350)

    Changed

    • Breaking: Commander 14 requires Node.js v20 or higher
    • internal refactor of Help class adding .formatItemList() and .groupItems() methods (#2328)
  • 4.0.0-1 - 2019-10-08
  • 4.0.0-0 - 2019-10-01
  • 3.0.2 - 2019-09-26
  • 3.0.1 - 2019-08-30
  • 3.0.0 - 2019-08-09

    Added

    • support multiple calls to .parse() with default settings (#2299)
    • add .saveStateBeforeParse() and .restoreStateBeforeParse() for use by subclasses (#2299)
    • style routines like styleTitle() to add color to help using .configureHelp() or Help subclass (#2251)
    • color related support in .configureOutput() for getOutHasColors(), getErrHasColors(), and stripColor() (#2251)
    • Help property for minWidthToWrap (#2251)
    • Help methods for displayWidth(), boxWrap(), preformatted() et al (#2251)

    Changed

    • Breaking: excess command-arguments cause an error by default, see migration tips (#2223)
    • Breaking: throw during Option construction for unsupported option flags, like multiple characters after single - (#2270)
    • Breaking: throw on multiple calls to .parse() if storeOptionsAsProperties: true (#2299)
    • TypeScript: include implicit this in parameters for action handler callback (#2197)

    Deleted

    • Breaking: Help.wrap() refactored into formatItem() and boxWrap() (#2251)

    Migration Tips

    Excess command-arguments

    It is now an error for the user to specify more command-arguments than are expected. (allowExcessArguments is now false by default.)

    Old code:

    program.option('-p, --port <number>', 'port number');
program.action((options) => {
  console.log(program.args);
});

    Now shows an error:

    $ node example.js a b c
error: too many arguments. Expected 0 arguments but got 3.

    You can declare the expected arguments. The help will then be more accurate too. Note that declaring
    new arguments will change what is passed to the action handler.

    program.option('-p, --port <number>', 'port number');
program.argument('[args...]', 'remote command and arguments'); // expecting zero or more arguments
program.action((args, options) => {
  console.log(args);
});

    Or you could suppress the error, useful for minimising changes in legacy code.

@snyk-bot
feat: upgrade commander from 1.0.0 to 14.0.0
26cb044 
Snyk has created this PR to upgrade commander from 1.0.0 to 14.0.0.

See this package in npm:
commander

See this project in Snyk:
https://app.snyk.io/org/sherfeyinv/project/02b601a1-d89d-441e-8049-1c9f3af1e1a7?utm_source=github&utm_medium=referral&page=upgrade-pr
@socket-security
Copy link

socket-security bot commented Aug 25, 2025

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security		 Vulnerability Quality Maintenance License
Addeduid2@​0.0.41001007176100
Addedpassport-strategy@​1.0.01001008376100
Updatedpassport-github@​0.1.5 ⏵ 1.1.099 +1100100 +1076100
Addedpassport-oauth2@​1.8.010010010076100
Addedbase64url@​3.0.110010010079100
Updatedcommander@​1.0.0 ⏵ 14.0.0100 +8100100 +184100

View full report

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@SherfeyInv @snyk-bot