diff --git a/tools/vcpm-sync/package-lock.json b/tools/vcpm-sync/package-lock.json
index cb557639..533d1006 100644
--- a/tools/vcpm-sync/package-lock.json
+++ b/tools/vcpm-sync/package-lock.json
@@ -459,9 +459,9 @@
       }
     },
     "minimist": {
-      "version": "1.2.0",
-      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz",
-      "integrity": "sha1-o1AIsg9BOD7sH7kU9M1d95omQoQ="
+      "version": "1.2.6",
+      "resolved": "https://registry.npmjs.org/minimist/-/minimist-1.2.6.tgz",
+      "integrity": "sha512-Jsjnk4bw3YJqYzbdyBiNsPWHPfO++UGG749Cxs6peCu5Xg4nrena6OVxOYxrQTqww0Jmwt+Ref8rggumkTLz9Q=="
     },
     "minipass": {
       "version": "2.3.5",
diff --git a/tools/vcpm-sync/package.json b/tools/vcpm-sync/package.json
index 08398d1d..9f257497 100644
--- a/tools/vcpm-sync/package.json
+++ b/tools/vcpm-sync/package.json
@@ -9,7 +9,7 @@
   },
   "dependencies": {
     "form-data": "^2.3.3",
-    "minimist": "^1.2.0",
+    "minimist": "^1.2.6",
     "node-fetch": "^2.5.0",
     "pacote": "^9.5.0"
   },