optimist (npm, GitHub) is no longer maintained and depends on a very old version of minimist which has a critical vulnerability, see here.