Bump @inquirer/prompts to 7.9.0 and version to 1.0.4

[Copilot]

@inquirer/prompts@^5.3.8 transitively depends on the unmaintained external-editor@3.1.0, which pulls in the vulnerable tmp@0.0.33 package.

Changes

• Updated @inquirer/prompts from ^5.3.8 to ^7.9.0 in packages/cli/package.json
• Bumped package version from 1.0.3 to 1.0.4
• Updated yarn.lock with new dependency resolutions

Impact

Version 7.x uses @inquirer/editor@4.2.21 → @inquirer/external-editor@1.0.2, which has no tmp dependency. The vulnerable dependency chain is completely eliminated from the CLI package.

The API for input, select, and confirm functions used by the CLI remains unchanged.

• Fixes Bump @inquirer/prompts to 7 to remove vulnerable tmp@0.0.33 sub-dependency #486

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Bump @inquirer/prompts to 7 to remove vulnerable tmp@0.0.33 sub-dependency</issue_title>
<issue_description>Hi Reflag team,

A small request to update @inquirer/prompts in the dependencies for the @reflag/cli package, since the current version (@inquirer/prompts@5.5.0) has a dependency to a package that isn't maintained anymore (external-editor) which includes a vulnerable dependency (tmp@0.0.33).

Thanks in advance 🙏 </issue_description>

<agent_instructions>Update @inquirer/prompts to 7.9.0</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Bump @inquirer/prompts to 7 to remove vulnerable tmp@0.0.33 sub-dependency #486

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Swiftwork]

Tested locally

[Swiftwork]

@copilot Bump version number and run yarn install

[Copilot]

@copilot Bump version number and run yarn install

Done in 56a8f5e. Bumped version from 1.0.3 to 1.0.4 and ran yarn install.

[Copilot]

Pull Request Overview

This PR upgrades the @inquirer/prompts package from version ^5.3.8 to ^7.9.0 in the CLI package. This is a major version bump that brings updated dependencies and new peer dependency requirements.

• Bumped package version from 1.0.3 to 1.0.4
• Updated @inquirer/prompts from ^5.3.8 to ^7.9.0 along with all its transitive dependencies

Reviewed Changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File	Description
packages/cli/package.json	Updated @inquirer/prompts dependency version from ^5.3.8 to ^7.9.0 and bumped package version to 1.0.4
yarn.lock	Updated lockfile entries for @inquirer/* packages and their dependencies to reflect the major version upgrade

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.