Fix security warning

[quilicicf]

Hi,

When installing chokidar (2.0.3) as a dependency of a project, npm gave me a warning about a vulnerability.

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ deep-extend                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ chokidar [dev]                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ chokidar > fsevents > node-pre-gyp > rc > deep-extend        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://nodesecurity.io/advisories/612                       │
└───────────────┴──────────────────────────────────────────────────────────────┘

Could you look into it please ?

Thanks for developing chokidar.
I can try and commit a fix if that helps, maybe it's just a version bump.

[paulmillr]

should be fixed now

[quilicicf]

Thanks for the fix!

[pjar]

Issue still present for me in version 2.0.4. GitHub has flagged it and suggests this:

Remediation
Upgrade deep-extend to version 0.5.1 or later. For example:

"dependencies": {
"deep-extend": ">=0.5.1"
}
or…
"devDependencies": {
"deep-extend": ">=0.5.1"
}

Link to CVE: https://nvd.nist.gov/vuln/detail/CVE-2018-3750