Bump @rushstack/ts-command-line to v5 to fix transitive ajv advisory (GHSA-2g4f-4pwh-qvx6)

[DmytroShalaiev]

Problem

npm audit reports a moderate finding for nested ajv (ReDoS / $data): GHSA-2g4f-4pwh-qvx6 — fixed in ajv >= 8.18.0.

With current umzug dependencies, npm resolves e.g.:

umzug → @rushstack/ts-command-line@4.x → @rushstack/terminal@0.15.x → @rushstack/node-core-library@5.13.x → ajv ~8.13.x (still in the vulnerable range per audit).

Context

Newer Rushstack releases already depend on patched ajv: e.g. @rushstack/node-core-library@5.22.0 declares ajv ~8.18.0. That chain is pulled in by @rushstack/ts-command-line@5.x (e.g. 5.3.5 → @rushstack/terminal@0.22.5 → @rushstack/node-core-library@5.22.0).

umzug currently depends on @rushstack/ts-command-line": "^4.12.2", which only resolves within 4.x (latest 4.23.7) and does not move to 5.x, so consumers stay on the old transitive ajv.

Request

Please bump the dependency to @rushstack/ts-command-line ^5.x (minimum version you’re comfortable supporting), run tests, and release a new umzug version so downstream projects get ajv >= 8.18.0 without npm overrides.

Thanks!

[HoldYourWaffle]

Duplicate of #715, fixed by #716.

[DmytroShalaiev]

Thanks