[gatsby] 4 vulnerabilities detected by new vscode extension `vscode-vuln-cost`

@wardpeet I got installed new free vscode extension from snyk - it analyzes dependencies which has vulnerabilities in code import statements

https://marketplace.visualstudio.com/items?itemName=snyk-security.vscode-vuln-cost

I’ve opened my gatsby project and it shows 4 vulnerabilities in ‘gatsby’ package.

Description

Describe the issue that you’re seeing.

Steps to reproduce

1. install https://marketplace.visualstudio.com/items?itemName=snyk-security.vscode-vuln-cost to your vscode.

2. open any gatsby project file which has import from ‘gatsby’ and wait till vscode extension analyze dependency graph

Expected result

Should be no vulnerabilities in project.

Actual result

extension detected 4 vulnerabilities in ‘gatsby’ project and printed 2 of them in details:

=== gatsby@2.20.14 ===

Indirect:
Medium Prototype Pollution in dot-prop@4.2.0
- https://snyk.io/vuln/SNYK-JS-DOTPROP-543489
Medium Prototype Pollution in yargs-parser@11.1.1
- https://snyk.io/vuln/SNYK-JS-YARGSPARSER-560381

No remediation available.

Environment

ystem: OS: macOS 10.15.4 CPU: (16) x64 Intel® Core™ i9-9980HK CPU @ 2.40GHz Shell: 5.7.1 - /bin/zsh Binaries: Node: 13.12.0 - ~/.nvm/versions/node/v13.12.0/bin/node Yarn: 1.22.4 - /usr/local/bin/yarn npm: 6.14.4 - ~/.nvm/versions/node/v13.12.0/bin/npm Languages: Python: 2.7.16 - /usr/bin/python Browsers: Chrome: 80.0.3987.163 Firefox: 74.0 Safari: 13.1 npmPackages: gatsby: 2.20.14 => 2.20.14 gatsby-plugin-catch-links: 2.2.1 => 2.2.1 gatsby-plugin-manifest: 2.3.3 => 2.3.3 gatsby-plugin-minify-classnames: 0.2.0 => 0.2.0 gatsby-plugin-no-sourcemaps: 2.2.0 => 2.2.0 gatsby-plugin-offline: 3.1.2 => 3.1.2 gatsby-plugin-purgecss: 5.0.0 => 5.0.0 gatsby-plugin-react-helmet: 3.2.1 => 3.2.1 gatsby-plugin-robots-txt: 1.5.0 => 1.5.0 gatsby-plugin-root-import: 2.0.5 => 2.0.5 gatsby-plugin-sitemap: 2.3.1 => 2.3.1 gatsby-plugin-sri: 1.1.0 => 1.1.0 gatsby-plugin-typescript: 2.3.1 => 2.3.1 gatsby-plugin-webpack-bundle-analyser-v2: 1.1.8 => 1.1.8 npmGlobalPackages: gatsby: 2.20.10

[JustFly1984]

@wardpeet I would recommend you to remove ^ prefix in semver for every dependencies and devDependencies, and setup tests, cos some dependencies could have bugs or misconfiguration even in patch versions, which breaks gatsby - for example devcert accident - update from 1.1.0 to 1.1.1 broken gatsby in all of our projects for several days. Every package version update should be reviewed, not just blindly trusting npm to install latest minor/patch version.

PS do not remove ^ for peerDependencies.

[JustFly1984]

not stale!