refactor: replace cli-color with picocolors

[JounQin]

cli-color -> es5-ext detected as a virus

medikoo/es5-ext#186

[ljharb]

Does anything but Kaspersky report it as a virus? The comments and links on that issue suggest that any antivirus company controllable by a hostile nation-state shouldn't be trusted, which includes Kaspersky.

[JounQin]

@ljharb I noticed this issue via https://github.com/apps/socket-security.

By the way, picocolors is much lighter.

[ljharb]

Unfortunately picocolors does not declare an engines field; does it support node 8+?

[JounQin]

Unfortunately picocolors does not declare an engines field; does it support node 8+?

https://app.unpkg.com/picocolors@1.1.1/files/picocolors.js

I think Node 6+ is supported, only let + Array#includes required.

[ljharb]

LGTM then

[JounQin]

I don't think the CI broken is related to this PR:

Run npm install -g pnpm@3 yarn@1
npm WARN notice [SECURITY] pnpm has the following vulnerabilities: 2 high, 1 moderate. Go here for more details: https://github.com/advisories?query=pnpm - Run `npm i npm@latest -g` to upgrade your npm version, and then `npm audit` to get more info.
npm ERR! path C:\npm\prefix\yarn.cmd
npm ERR! code EEXIST
npm ERR! Refusing to delete C:\npm\prefix\yarn.cmd: is outside C:\npm\prefix\node_modules\yarn and not a link
npm ERR! File exists: C:\npm\prefix\yarn.cmd
npm ERR! Move it away, and try again.

npm ERR! A complete log of this run can be found in:
npm ERR!     C:\npm\cache\_logs\2025-0[4](https://github.com/nathanhleung/install-peerdeps/actions/runs/14250611119/job/39943052401?pr=256#step:6:5)-03T19_10_31_722Z-debug.log

[ljharb]

I agree, but it passed 2 weeks ago, so I'm not sure what the issue is. It'll have to wait until that's resolved.

[JounQin]

I agree, but it passed 2 weeks ago, so I'm not sure what the issue is. It'll have to wait until that's resolved.

@ljharb Maybe just retry failed workflows? I noticed that Windows + Node 8/10/12+ all works.

[ljharb]

That doesn't seem to do it.

[JounQin]

yarnpkg/yarn#2816 (comment)

@ljharb Maybe --force is needed?

[nathanhleung]

For some reason, Node 9 and 11 (but no other versions) have been consistently failing on Windows and I haven't had time to figure out exactly why (see previous PRs: #254, #255).

@JounQin wanna open a PR updating the workflow and we can see if the solution in the linked issue works?

[JounQin]

@nathanhleung Just tried 7efd77b (#256)

[nathanhleung]

@JounQin approved your workflow

[JounQin]

Sadly it doesn't work, I'll revert back.

[JounQin]

@nathanhleung So are we good to merge with the two known broken workflows?

[JounQin]

Friendly ping @nathanhleung

[nathanhleung]

Friendly ping @nathanhleung

@JounQin thanks, merged and will cut a new release shortly.

[nathanhleung]

Released in v3.0.7