Remove Vorpal.js dependency

[jahed]

Vorpal.js is barely maintained and has out of date dependencies, some with security alerts (though it's mitigated by using more recent versions in night-patrol since they're caret versions).

Vorpal is just a layer over Inquirer so it can switch to that with some work.

[jahed]

Tried forking Vorpal to upgrade dependencies, but there's too many and pretty much all of them go up several major versions.

[jahed]

The vulnerable dependency specifically is an old version of lodash coming from an old version of Inquirer. To fix this, the user needs to have in their package.json:

  "resolutions": {
    "night-patrol/vorpal/inquirer/lodash": "4.17.14"
  }

Though this is a major version mismatch, nothing seems to break on night-patrol so seems to be safe.

https://github.com/lodash/lodash/wiki/Changelog#v400

[jahed]

Terminal Kit looks like a good alternative.

https://github.com/cronvel/terminal-kit

[jahed]

I tried migrating to TerminalKit by replicating Vorpal's interface. It's a lot of work. Terminal Kit is low-level and has some weird behaviour with input capturing. e.g. I couldn't figure out how to CTRL+C to send a SIGINT. Also it seems to need some clean up so the terminal isn't left in a "bad state". A lot of terminal-related behaviour to learn. Not sure if it's worth going through that, vs. attempting to maintain Vorpal.

I'll try forking Vorpal first as generally it seems like a more convenient tool. If I am replicated its interface in another tool, I might aswell try to do it inside-out.