Update mkdirp to 0.5.3 which removes the vulnerable dep on minimist

[mjziolko]

https://npmjs.com/advisories/1179

mkdirp has a dependency on minimist which has a prototype pollution vulnerability. Manually updating to 0.5.3 fixes this issue.

[efr-chriswilliams]

commenting to watch progress

[jrichardsz]

• current status : failed
• https://ci.appveyor.com/project/Mapbox/node-pre-gyp

I tried to get the error details with no luck. How can I help you?

[Naktibalda]

This change is unnecessary ^0.5.1 allows any version lower than 0.6.

In fact, I checked out node-pre-gyp repo, ran npm install and got a clean npm audit report:

node-pre-gyp$ npm audit --registry https://registry.npmjs.org/

                       === npm audit security report ===

found 0 vulnerabilities
 in 338 scanned packages

node-pre-gyp$ npm ls minimist
[email protected] /c/Users/Eckoh/sites/node-pre-gyp
├─┬ [email protected]
│ └── [email protected]
├─┬ [email protected]
│ └── [email protected]  deduped
└─┬ [email protected]
  └── [email protected]  deduped

npm ls mkdirp
[email protected] /c/Users/Eckoh/sites/node-pre-gyp
├── [email protected]
├─┬ [email protected]
│ └── [email protected]  deduped
└─┬ [email protected]
  └── [email protected]  deduped

[karlhorky]

This change is unnecessary ^0.5.1 allows any version lower than 0.6.

@Naktibalda This change removes the possibility for 0.5.1 or 0.5.2 to be selected as a transitive dependency, forcing npm and Yarn to resolve to at least 0.5.3.

These previous versions may be saved in lockfiles. Consider that many users do not know that they can upgrade transitive dependencies in lockfiles. So for those users who have one of the older versions saved in a lockfile, this change will bump this version for them. If one of their top-level dependencies depends on this change, then they just need to upgrade the top-level dependency.

So I would vote for making this change.

[jrichardsz]

Error continues. Github says:

Upgrade minimist to version 0.2.1 or later.

And bcrypt continues using: 0.0.8
├─┬ [email protected]
│ └─┬ [email protected]
│ ├─┬ [email protected]
│ │ └── [email protected]
│ └─┬ [email protected]
│ └── [email protected]