Security vulnerability in node-pre-gyp dependency

[nealalpert]

Node Security Project is reporting a prototype pollution attack present in one of the dependencies of fsevents.

If node-pre-gyp 0.6.39 is replaced by 0.6.37 all of fsevent's tests still pass and the vulnerable module is no longer used.

[bnoordhuis]

Thanks for the bug report but it's basically a non-issue. node-pre-gyp is the build tool, it's not used by fsevents at runtime. Prototype pollution is not a concern.

edit: also, duplicate of #198.

[es128]

When node-pre-gyp publishes a version with updated deps I'll update the version bundled with fsevents to suppress the warnings.

[andyhayes]

@es128 node-pre-gyp has now upgraded (see mapbox/node-pre-gyp#347). Please can you update fsevents?

Edit: nevermind, just seen #201 :)