Update mocha dependency

[jtakalai]

This fixes the deprecated fsevents transitive dependency.

When I do an npm install in my own project, I get:

npm WARN deprecated [email protected]: "Please update to latest v2.3 or v2.2"

And further investigating with npm ls fsevents:

│ └─┬ [email protected]
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └── [email protected]

After bumping mocha to the latest, I see that chokidar is also 3.5.3 and it has [email protected], so all good.

Thanks for maintaining this great coverage tool!

[codecov-commenter]

Codecov Report

Base: 95.90% // Head: 95.90% // No change to project coverage 👍

Coverage data is based on head (970a89f) compared to base (8d49be0).
Patch has no changes to coverable lines.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #758   +/-   ##
=======================================
  Coverage   95.90%   95.90%           
=======================================
  Files          19       19           
  Lines        1050     1050           
=======================================
  Hits         1007     1007           
  Misses         43       43           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[alannotnerd]

Nice job!

[dbmikus]

Is there a reason that Mocha cannot be a peer dependency?

[leric7]

Why don't we merge this PR?

[CJ42]

@cgewecke
This PR should really be merged.

This old version of Mocha (7.1.2) uses an old version of the minimatch package that contains a Regular Expression Denial of Service (ReDoS) vulnerability.

Considering Solidity coverage is included as a dependency in hardhat-toolbox, this might affect many projects that use Hardhat.

https://security.snyk.io/vuln/SNYK-JS-MINIMATCH-3050818
GHSA-f8q6-p94x-37v3

Flagged by the dependabot of the ERC725 smart contracts repository

[cgewecke]

Sorry, done in #810