Update watchpack to the most recent minor version to remove minimist vulnerability.

[mjziolko]

https://npmjs.com/advisories/1179
#10561

webpack has a prototype pollution vulnerability down the tree and I'm going through and creating patches for the deps on this semver.

webpack/watchpack#148
paulmillr/chokidar#993
mapbox/node-pre-gyp#492

What kind of change does this PR introduce?

Updates the minor version of watchpack

Did you add tests for your changes?

Nein, not sure if this needs one.

Does this PR introduce a breaking change?

Nein, but the version of watchpack that is being added here does not technically exist yet, so checks will fail until then.

What needs to be documented once your changes are merged?

That this vulnerability has been patched.

[webpack-bot]

For maintainers only:

• This needs to be documented (issue in webpack/webpack.js.org will be filed when merged)
• This needs to be backported to webpack 4 (issue will be created when merged)

[alexander-akait]

Do not need it, dependabot do it automatically after release

[jomi-se]

Hi @evilebottnawi 👋

Would you mind telling me if there is any ETA for the release cycle for dependabot changes? Is it something like a couple of hours or a couple of days? Trying to handle a broken build due to npm audit stuff

Thank you 🙌

[jomi-se]

(Nevermind, we were able to just let npm update the internal dependencies by recomputing them. Thanks anyway)

[jay-meister]

@jomi-se can you add what you ran in order to fix this issue in your project?

[jomi-se]

@JMurphyWeb Here is what I did to fix this in a project that has webpack as a dependency:

• I first ran npm audit fix so that everything that could be automatically fixed, was fixed.
• Then I ran npm audit again to get the list of remaining issues.
• Then I did a text search in my package-lock.json for "mkdirp": { and removed this entry from the package-lock.json (not just the line, the full json entry for this package)
• I ran npm i and most cases were fixed but minimist was still included bundled in fs-events according to npm audit so I removed that entry from fs-events and run npm i again.

Problem fixed and package-lock.json minimally updated.

If you can afford it you can just delete your package-lock.json (or the equivalent yarn file) and just reinstall everything

I'm not sure there is a way to do this in a single npm command instead of having to do all of this by hand

[webpack-bot]

@mjziolko Thanks for your update.

I labeled the Pull Request so reviewers will review it again.

@evilebottnawi Please review the new changes.

[webpack-bot]

Thank you for your pull request! The most important CI builds succeeded, we’ll review the pull request soon.

[sokra]

Thanks

[karlhorky]

@jomi-se @JMurphyWeb and anyone else, if you're using Yarn v1, I've created a comprehensive guide about keeping transitive dependencies up to date, including upgrading them by hand in the yarn.lock file:

https://twitter.com/karlhorky/status/1246138834473095169
https://github.com/karlhorky/yarn-security-fixes/blob/master/readme.md