Prototype pollution of dependency yargs

[tanettrimas]

Is this a feature request or a bug?

Bug

What is the current behavior?

I am getting security vulnerabilities from yargs-parser as you are using the yargs dependency. Even if I see that you recently updated packages in this PR: #1902, maybe you could try to do this again?

I ran npm audit fix, and got that it needed manual review.

Version information (for bug reports)

• Firefox version: 76.0.1
• Your OS and version: Mac OS Catalina 10.15.2
• Paste the output of these commands: npm audit fix

node --version 12.14.1 && npm --version 6.14.5 && web-ext --version 4.2.0

[Rob--W]

This has been fixed in #1902, but we haven't published an update yet.

[tanettrimas]

@Rob--W Thanks for the clarification :)

[rpl]

Closing as fixed (web-ext v4.3.0 has been just released on npm).