Update mkdirp for security

[SakiiCode]

minimist had to be upgraded to 1.2.3

https://www.npmjs.com/advisories/1179

Edit:

PSA: There is a TEMPORARY way to force minimist to a higher version. Although unlikely but it may cause other issues! Use this only until this PR gets merged!

1) Add this to the "scripts" section of your your package.json

    "preinstall": "npx npm-force-resolutions"

2) Add this to the end of your package.json

  "resolutions": {
    "minimist": "^1.2.5"
  }

3) Run npm install
4) Be sure to check your dependency tree with npm ls minimist. Only the necessarily overridden packages should be marked as invalid. (children of extract-zip in this case)

│     └─┬ extract-zip@1.6.7
│       ├── minimist@1.2.5  extraneous
│       └─┬ mkdirp@0.5.1
│         └── minimist@1.2.5  invalid

[Hypnosphi]

@malept can you please merge & release?

[abrom]

For reference, the changes from v0.5.1 to v0.5.3 of mkdirp are: isaacs/node-mkdirp@d4eff0f...v0.5.3 (the only practical change being the minimist dependency bump from 0.0.8 to ^1.2.5)

[brettz9]

Just to connect to issue filed: #86

[brettz9]

Anything else holding this back?

[cyclingzealot]

@brettz9 No, except that @maxogden, who I believe has sole authority to execute this merge, has not been active on this project since May 2018, despite being active in private repos. It could be that he just needs a few more days for this to get to the top of his queue. He seems very busy.

@brettz9 : Are you here because of the dependency from puppeteer or another package?

Looking at his github profile and https://maxogden.com/, I suspect he is located in Portland, Washington. That state, along with California and New York, has been particularly hit hard by COVID-19, and it's only going to get worse. Wishing everyone the best.

[cyclingzealot]

@SakiiCode's suggestion of using https://www.npmjs.com/package/npm-force-resolutions was tried successfully (along with npx and entries in package.json) as documented in vuejs/vue-cli#5285 (comment)

[cyclingzealot]

@SakiiCode There's a suggestion of using 1.0.3 (#86 (comment)) instead as it doesn't depend on minimist. I'm not familiar enough with pull requests to see if I, as commentator, can edit them.

[SakiiCode]

@cyclingzealot 1.0.3 (besides other changes) uses promises instead of callbacks so migration requires the rewrite of the main and the testing script as well. Switching to it may be possible in the future but it's a bit out of scope of this PR.

Thanks for pointing out though

[daveisfera]

@SakiiCode There's a suggestion of using 1.0.3 (#86 (comment)) instead as it doesn't depend on minimist. I'm not familiar enough with pull requests to see if I, as commentator, can edit them.

In node 10 (the currently oldest supported version), there's also a {recursive: true} option so mkdirp could potentially be skipped all together

[cyclingzealot]

As suggested by @SakiiCode, I used https://www.npmjs.com/package/npm-force-resolutions as a temporary fix. I documented on SO at https://stackoverflow.com/a/60795003/1611925 and https://stackoverflow.com/a/60794976/1611925 . It installed without difficulty but I have not tested execution yet.

[brettz9]

@brettz9 : Are you here because of the dependency from puppeteer or another package?

svg2png -> phantomjs-prebuilt

@brettz9 No, except that @maxogden, who I believe has sole authority to execute this merge, has not been active on this project since May 2018, despite being active in private repos. It could be that he just needs a few more days for this to get to the top of his queue. He seems very busy.

Sure. Though per https://www.npmjs.com/package/extract-zip @malept is listed as an npm "collaborator" who should I think per this designation also be able to make an update.

Looking at his github profile and https://maxogden.com/, I suspect he is located in Portland, Washington. That state, along with California and New York, has been particularly hit hard by COVID-19, and it's only going to get worse. Wishing everyone the best.

Indeed.

@jfoclpf : Maintainers who put their name on a project typically want to take a good look, run tests, etc., so even a one-line change can need to be shelved until a person has the time to look everything over and be satisfied that the specific fix is the best way to go. Of course one hopes with vulnerabilities, there can be some added priority, but if it comes down to it, any of us can release a forked project.

[jfoclpf]

@brettz9 If I understood correctly the only proposed difference is the version of a dependency, thus it is one line in package.json that changes. If npm test is well designed and configured in travis you don't even need to worry about tests cause you may only pull request if the test on the proposed changes passes successfully. When it comes to automatic pull requests from github regarding vulnerability I just blindly accept them. Look, I am also a developer of open source, and I perfectly understand we have no duties at all regarding our products that we set available for free. But here is just a minor version change in a dependency which is ready to go. Anyway this is a great package ;)

[SakiiCode]

@cyclingzealot I added a tutorial to the first post, please check if you did the same steps and got the same results.

[malept]

Thanks for your patience in these uncertain times. I've released a version of extract-zip depending on mkdir 0.5.4 in version 1.6.8.

[brettz9]

Thank you very much, @malept, and thanks for your contributions to the project! Just may want to clarify that you released a version depending on "mkdirp" (as there is also a "mkdir" npm package as well). :-) Best wishes...

[jfoclpf]

Thanks @malept :) All the best!