Create-react-app: Update dependencies that include mixin-deep

[stevenroussey-privicy]

Describe the bug

npm audit fix
found 12999 high severity vulnerabilities
  run `npm audit fix` to fix them, or `npm audit` for details

Running npm audit shows all the packages that depend on mixin-deep somewhere in the dependency tree. For my scrollback buffer it looks a lot like this:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ mixin-deep                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > webpack > micromatch > braces > snapdragon > │
│               │ base > mixin-deep                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1013                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ mixin-deep                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.0.1                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ react-scripts > webpack > micromatch > extglob >             │
│               │ expand-brackets > snapdragon > base > mixin-deep             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1013                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

I doubt I am the first to see this, but you might as well have a tracking issue.

[josias-r]

While working, I installed some dependencies and suddenly had 13000 vulnerabilities. I first thought the new packages were the reason. 😂

... It's not just mixin-deep, its also set-value.
Those vulnerabilities have been published today:
https://www.npmjs.com/advisories/1012
https://www.npmjs.com/advisories/1013

Edit:
Now that it has been fixed, you probably need to delete package-lock.json to get the versions.

[heyimalex]

They've both been fixed! Advisories were changed to include fixed patch versions.