chore(deps): bump flat from 4.1.1 to 5.0.1

[dependabot]

Bumps flat from 4.1.1 to 5.0.1.

Commits

• f25d3a1 Release 5.0.1
• 54cc7ad use standard formatting
• 779816e drop dependencies
• 2eea6d3 Bump lodash from 4.17.15 to 4.17.19
• a61a554 Bump acorn from 7.1.0 to 7.4.0
• 20ef0ef Fix prototype pollution on unflatten
• e8fb281 Test prototype pollution on unflatten
• 6e95c43 Add node 10 & 12 to travis config.
• 38239cc Release 5.0.0
• beaea9d Add tests around cli. Only show usage if on TTY & no argument, allow eaccess ...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

[ankitr-nalkv]

npm audit is throwing error for this dependency. Can this please be merged @dziraf and a new version released

[eagafonov]

I was going to submit a new issue for this, but there is PR to address for that.
Anyway, here is my instigation results I was going to submit

npm audit reports a false-positive critical vulnerability on a peer dependency [email protected]

A new advisory published two weeks ago marks flat<5.0.1 as critically vulnerable.
GHSA-2j2x-2gpw-g8fm

AdminJS depends on [email protected], so npm audit reports the critical vulnerability since then.
Actual fix was backported and published to [email protected], so it is a false-positive security audit report.
hughsk/flat#105
hughsk/flat#106

Please consider bumping flat's version up to the latest 5.0.2

[SpaceOso]

Hi! Can this PR be merged please?

[dziraf]

v5 is a major version update and flat package has no changelog I can find, so this has to be tested first

[eagafonov]

Hi, @dziraf

I hope it would help. I've just reviewed the difference from v4 to v5 (4.1.1 -> 5.0.2)

TL;DR: API looks backward compatible to me.

Here is the summary:

• Additional option transformKey to transform each part of a flat key before and after flattening.
• Get rid of is-buffer dependecy by coping it.
• CLI: the tool fails if the source file is not readable.
• Update .travis.yaml to support up to NodeJS v14
• Bump versions of dev dependencies.
• Fix typo on README.

To see the difference I run:

git clone https://github.com/hughsk/flat
cd flat
git difftool  4.1.1..5.0.2

[dziraf]

I'll close this in favour of #1382 as I also bumped types and our design system.

v5 should work from what I tested locally

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.