Backport of security patch, for benefit of yargs

I know it’s a pain in the neck, but would you consider back-porting https://github.com/chalk/ansi-regex/pull/37 to the 5.x.x release line, for the benefit of yargs.

Yargs is making the effort during the transition to ESM to support both CJS and ESM, which makes us unable to update to the latest version of string-width.

If you were willing to make an exception (I know you’re pushing folks towards using ESM exclusively) it would be really valuable for yargs users using CJK character sets.

[cardil]

GitHub Advisory Database still lists this package as affected for <6.0.1, here: https://github.com/advisories/GHSA-93q8-gq69-wqmw

Anyone knows how to update that information as well?

This page https://docs.github.com/en/code-security/security-advisories/creating-a-security-advisory suggest the repo owner should be able to edit this information.

[sindresorhus]

The range in the report says <5.0.1 but it has not been proven that all versions below 5.0.0 are vulnerable. (Snyk: You should generally not just assume all previous versions are affected by default).