Package is dependent on vulnerable versions of json5

[davidgc-wisenet]

According to yarn audit:

tsconfig-paths had a dependency with JSON5 which was recently updated. I suggest that the version of this library is updated in order to avoid this vulnerability.

yarn audit v1.22.5
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high          │ Prototype Pollution in JSON5 via Parse Method                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ json5                                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=2.2.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ eslint-plugin-import                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ eslint-plugin-import > tsconfig-paths > json5                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1085271                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
1 vulnerabilities found - Packages audited: 1183

[ljharb]

json5 v1.0.2 has already been updated with this fix, and either way, it's not a valid vulnerability for eslint-plugin-import.

As is the case with almost every JS CVE, the best course of action is to do nothing until the ecosystem fixes it for you.

This is a duplicate of #2625; a duplicate of #2628; a duplicate of #2626; a duplicate of #2627; a duplicate of #2631; a duplicate of #2632; a duplicate of #2634; a duplicate of #2635; a duplicate of #2636; a duplicate of #2637; a duplicate of #2639.

Please stop filing issues about a vulnerability on "not the vulnerable package", it doesn't help.