Critical security vulnerability in new buidler projects

[pemulis]

Discovered this during the Hack Money hackathon.

builder uses mocha@5.2.0 which uses mkdirp@0.5.1 which uses minimist@0.0.8. When I uploaded my newly buidler'd repo to GitHub, I received this complaint about a critical security vulnerability.

Details here: GHSA-vh95-rmgr-6w4m

Perhaps this could be fixed by updating to mocha@7.1.2, which updates mkdirp to v.0.5.5?

Looks like mkdirp is getting the boot from mocha@8.0.0 (they discuss the vulnerability here): mochajs/mocha#4199

[alcuadrado]

Hey @pemulis!

Thanks for reporting this, and for the details about it.

I believe we aren't exposed to this vulnerability, but npm has no way to realize this, and it warns everyone anyway, so we'll fix it asap.

We'll keep this issue updated.

[fvictorio]

I'm gonna guess this is not relevant anymore. Please re-open if it is.