Security vulnerability linked to nodemon

Hi,

A security vulnerability was found in event-stream https://github.com/dominictarr/event-stream/issues/116 Any version past 3.3.4 may be vulnerable.

A vulnerable version of EventStream is present in the dependency tree of bull-arena via nodemone@1.18.4

└─┬ bull-arena@2.5.0
  └─┬ nodemon@1.18.4
    └─┬ pstree.remy@1.1.0
      └─┬ ps-tree@1.1.0
        └─┬ event-stream@3.3.6 
          └── flatmap-stream@0.1.2

It is advised to upgrade to nodemon@^1.18.7 to get rid of the problematic dependency tree.

[skeggse]

Published as v2.5.1.

[eeVoskos]

There is a problem specifically with cloud deployments (namely Google AppEngine). Even if you replace the dependency in package-lock.json, npm i is run by the build system and replaces nodemon with the “malicious” version, causing build errors.