High severity vulnerability detected in sane dependencies

[harol-rodriguez]

Versions

• nuxt: v2.14.7
• node: v12.14.0

Reproduction

A security assessment was performed and vulnerabilities were found to dependency sane

It is requested to update from version " y18n": "^4.0.0" to " y18n": "^5.0.5"

reference:
yargs/y18n#107
yargs/y18n#108

Additional Details

What is Expected?

What is actually happening?

[danielroe]

@harol-rodriguez

• sane is not installed in Nuxt's production dependencies; it is a dependency of jest and only installed in development
• node-sass seems to be the only non-development package that depends on y18n. The latest version of node-sass still depends on sass-graph which depends on yargs 13 (latest is 16). However node-sass should only be run in the development/build-time environment of a user of Nuxt so I doubt this is a significant risk in context. Users can always provide a yarn resolution to pin their y18n version as appropriate.