@babel/core: Upgrade json5 to 2.1.2

In @babel/core 7.8.7, the current version of json5 (2.1.1) depends on a version of minimist that contains the security vulnerability CVE-2020-7598. Can we update json5 to 2.1.2 to resolve this?

[paulmillr]

pushed fsevents 1.2.12

[nicolo-ribaudo]

@adamu

@babel/cli > chokidar > fsevents > node-pre-gyp > rc > minimist

There is a problem here: we can’t upgrade to chokidar v3 in Babel 7 because it contains breaking changes that would be reflected to our users.

• @babel/cli has an optional dependency on chokidar@^2.1.8.
• chokidar@2.1.8 has an optional dependency on fsevents@^1.2.7
• fsevents@1.2.11 bundles all its dependencies, including minimist@0.0.8

There are a few solutions:

1. With yarn, you could try to force a chokidar@3 upgrade using the resolutions field in package.json. Maybe the breaking change doesn’t affect you.
2. With npm, you can try using npm-force-resolutions to force a chokidar@3 upgrade. npm audit will still complain, but you won’t actually have the unsecure code.
3. You can use npm --no-optional to avoid installing chokidar@2 (you might first have to delete your package-json.lock)
4. You can ask to the fsevents maintainers to release a fsevents@1.2.12 version, which would be automatically picked up by chokidar@2. Even if the last version is 2.1.2, it looks like the v1 release line is still maintained.