I found this old-ish issue which I suspect should be closed: #883

But even the latest version of commitizen contains the following issue:

# npm audit report

tmp  <=0.2.3
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter - https://github.com/advisories/GHSA-52f5-9888-hmc6

Caused by:

├─┬ [email protected]
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]

This issue is still not fixed as of now, even in the latest inquirer version. But once this issue is resolved, the inquire package should be updated: SBoudrias/Inquirer.js#1802