Please read regarding NPM "vulnerability" report

[jonschlinkert]

tldr; This was fixed. NPM is outdated. Use Snyk to check instead.

Please don't create issues about vulnerabilities, or pull-requests, related to mixin-deep. The library was patched, and we don't need to do any additional work here. You will automatically get the patched version by deleting node_modules and reinstalling.

However, NPM is erroneously reporting the vulnerability still. You can see that NPM is incorrect by running Snyk.

Please read this for more information on fixing the issue.

[mkj28]

For the people using yarn:

1. Find mixin-deep in yarn.lock and delete it
2. Run yarn install- that bumps mixin-deep (for example if base has mixin-deep "^1.2.0" dependency- it gets bumped to non-vulnerable 1.3.2)