package is pulling in a vulnerable version of `fast-redact`

[G-Rath]

GHSA-ffrw-9mx8-89p8 impacts all versions of fast-redact, which netlify-cli pulls in via fastify > pino:

└─┬ netlify-cli@23.9.4
  └─┬ fastify@4.29.1
    └─┬ pino@9.9.5
      └── fast-redact@3.5.0

This has been addressed in pino v9.12.0 which replaces fast-redact with slow-redact, but while this version is allowed by fastify v4.29.1, the npm-shrinkwrap.json that netlify-cli ships with does not.

[serhalp]

Thanks for reporting @G-Rath. Would you be open to sending us a PR?

[G-Rath]

Appreciate the patch, though now updating brings in a vulnerable version of tar so we need #7758 released 🙃