@posthog/cli ships outdated shrinkwrapped transitive deps with open CVEs (axios, follow-redirects, minimatch, brace-expansion)