High severity security vulnerability in dot-prop

Seeing the following:

                       === npm audit security report ===


                                 Manual Review

             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance
High            Prototype Pollution

  Package         dot-prop


  Patched in      >=5.1.1

  Dependency of   gatsby

  Path            gatsby > devcert > configstore > dot-prop

  More info       https://npmjs.com/advisories/1213

  High            Prototype Pollution

  Package         dot-prop

  Patched in      >=5.1.1

  Dependency of   gatsby

  Path            gatsby > gatsby-cli > update-notifier > configstore >
                  dot-prop

  More info       https://npmjs.com/advisories/1213

How do we go about getting dot-prop updated for these components of gatsby?

[herecydev]

gatsbybot got a little hasty there, still needs devcert to be patched

[mobidev111]

Fixing this is important & urgent.

• right now most gatsby-cli versions fail ‘npm audit’ (nam security audit)
• this immediately breaks the CI pipelines of everybody using gatsby-cli
• there are workarounds, but exceptions from the security audit are seldomly/hard to administer for obvious reasons