Firebase-tools: High vulnerability package need to be updated [dot-prop]

[YahangWu]

Package update request.

the dot-prop package has been found vulnerable and needed to be updated.

[REQUIRED] Environment info

8.6.0

firebase-tools:

macOS

Platform:

[REQUIRED] Test case

npm audit

[REQUIRED] Steps to reproduce

npm audit

[REQUIRED] Expected behavior

no vulnerability

[REQUIRED] Actual behavior

found 2 high severity vulnerabilities in 1370 scanned packages

[google-oss-bot]

This issue does not seem to follow the issue template. Make sure you provide all the required information.

[samtstern]

@WuHarry thanks for filing this! I tried to get GitHub's dependabot to fix it automatically but it said:

Dependabot cannot create a pull request as one or more other dependencies require a version that is incompatible with this update.

I'll see why. Might have to file a bug against some of our dependencies.

[samtstern]

Here's the tree:

$ npm ls dot-prop
[email protected] /Users/samstern/Projects/firebase-tools
├─┬ [email protected]
│ └── [email protected] 
├─┬ [email protected]
│ └─┬ @google-cloud/[email protected]
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └── [email protected] 
└─┬ [email protected]
  └─┬ [email protected]
    └── [email protected] 

Let's see if we can update update-notifier

[samtstern]

@WuHarry we've done all we can do here, @bkendall is working on an update to superstatic which will fix the transitive dep.