Update chokidar to current version

[aman-agarwal93]

The chokidar is an optional dependency yet it is on 2.* version which involves vulnerability of kind-of package as follows :

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Please upgrade the version to the latest.

[aman-agarwal93]

@fdintino Please look into the issue. The chokidar has been upgraded to 3.x versions.

[aman-agarwal93]

@eklingen I have seen you raised a PR for the same. Can you please escalate it to get it merged sooner?

[aman-agarwal93]

Hello, I haven't seen any activity for the same.
Please update the chokidar dependency to the latest.

[aman-agarwal93]

@eklingen @fdintino

[DevRCRun]

It appears snyk have now published this with a POC https://app.snyk.io/test/npm/nunjucks/3.2.0

https://snyk.io/vuln/SNYK-JS-MINIMIST-559764

[fdintino]

I will update this today.

[antonsamper]

Linking PR #1254

[antonsamper]

@fdintino This issue can be closed as the fix was merged in #1254

[eran10]

there is again a security issue with snyk and chokidar
https://app.snyk.io/test/npm/nunjucks/3.2.2

[ogonkov]

chokidar is a peer dependency, it is not lock end user from manually update their chokidar dependency