Chokidar: Update upath version to fix vulnerability warning

[nikoladev]

After running a scan with Retire.js I got a warning that underscore.string uses a vulnerable jQuery version for some of its tests.

I looked around a bit and because this is only in a test file the vulnerability is not dangerous for end-users. But it would be nice to not scare other developers :)

upath fixed the issue by updating to the latest version of underscore.string in v1.0.1. So by updating upath to v1.0.1 or higher the vulnerability warning should be fixed.

I can submit a PR to change the upath version in package.json but I'm not 100% confident that the change will be bug-free as I'm not familiar with the codebase. If any of the maintainers could have look at it, that would be great.

[es128]

This was resolved by #679. I hadn't been planning on it, but I guess I'll publish a patch update to resolve the concern you're raising.

[danielweck]

Now that upath is allowed to update in package.json (^1.0.0 instead of 1.0.0), could you please publish a Chokidar release, so that NodeJS >7 is supported.
See:
https://github.com/paulmillr/chokidar/pull/679#issuecomment-365436112

[danielweck]

Follow-up: ah, it turns out that --engine-strict can default to true in some cases!
mkdir ChokidarTest && cd ChokidarTest && npm init --yes && npm install chokidar --engine-strict=false
=> okay.
By forcing --engine-strict to false, I should be able to get around this issue.

[es128]

Just published 2.0.2

[danielweck]

Yep, npm install* now works (without --engine-strict=false), thanks for v2.0.2 :)

(* rm -rf node_modules && rm package-lock.json && npm install)

[nikoladev]

Can confirm that the problem is fixed for me as well. Chokidar was installed through nodemon for me, so I just deleted and re-added it:

yarn remove nodemon
yarn add nodemon