Upgrade mkdirp 0.5.1 -> 0.5.3 to resolve minimist vulnerability

[prios-ben-beckerman]

The dependency mkdirp is pinned to 0.5.1. Mkdirp 0.5.1 has its own pinned dependency, minimist 0.0.8, which has a vulnerability. extract-zip should be upgraded to use mkdirp 0.5.3 which uses a newer version of minimist.

See isaacs/node-mkdirp#7

[heitorlessa]

mkdirp has a new major version that no longer depends on minimist - v1.0.3, please use that instead.

[mnepita]

I am having the same issue , can we please get an update ?

[cyclingzealot]

@mnepita : plenty of discussion in #85. We're basically waiting on the repo owner (not me) to execute & deploy the pull request. In the meantime, I'm going to try vuejs/vue-cli#5285 (comment) and report back here, #85 and / or stack overflow.

[jfoclpf]

Same here, please update asap

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ words-pt [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ words-pt > extract-zip > mkdirp > minimist                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[cyclingzealot]

As suggested by @SakiiCode, I used https://www.npmjs.com/package/npm-force-resolutions as a temporary fix. I documented on SO at https://stackoverflow.com/a/60795003/1611925 and https://stackoverflow.com/a/60794976/1611925 . It installed without difficulty but I have not tested execution yet.

[DanielRuf]

Bump.

[DanielRuf]

cc @malept

[prios-ben-beckerman]

Owner of this project is @maxogden

[DanielRuf]

Owner of this project is @maxogden

I know, but @malept is another contributor here.

[malept]

Thanks for your patience in these uncertain times. I've released a version of extract-zip depending on mkdir 0.5.4 in version 1.6.8.