[deps] updates pika/pack to a non vulnerable version

[nickfloyd]

There is a known set of vulnerabilities in pika/pack. The intention of this PR is to update pika/pack to a non-compromised version.

It appears that pika/pack v0.4.0 depends on:

node_modules/meow/node_modules/yargs-parser
  meow  3.4.0 - 5.0.0
  Depends on vulnerable versions of trim-newlines
  Depends on vulnerable versions of yargs-parser
  node_modules/meow
    np  >=2.0.0
    Depends on vulnerable versions of meow
    Depends on vulnerable versions of npm-name
    Depends on vulnerable versions of update-notifier
    node_modules/np
      @pika/pack  >=0.4.0-pre.2
      Depends on vulnerable versions of np
      node_modules/@pika/pack

Which has 12 vulnerabilities

v0.5.0 depends on:

node_modules/meow/node_modules/yargs-parser
  meow  3.4.0 - 5.0.0
  Depends on vulnerable versions of trim-newlines
  Depends on vulnerable versions of yargs-parser
  node_modules/meow
    np  >=2.0.0
    Depends on vulnerable versions of meow
    Depends on vulnerable versions of npm-name
    Depends on vulnerable versions of update-notifier
    node_modules/np
      @pika/pack  >=0.4.0-pre.2
      Depends on vulnerable versions of np
      node_modules/@pika/pack

Which also has 12 vulnerabilities

Whereas v0.3.7 has no known vulnerabilities. These vulnerabilities were introduced in the past two versions of pika/pack.

pika/pack appears to have been abandoned / or put on hold. Additionally, the updates to the dependencies have been made to the source in master but have not been released.

It looks like our best options are to:

1. Downgrade to v0.3.7 (currently there seem to be no side effects to making this change, and it solves the vulnerabilities being flagged by the repo)
2. Find an alternative

[timrogers]

@nickfloyd It looks like builds are failing due to the pika binary being missing (example). Any ideas?

[wolfy1339]

This has happened before, I have opened an issue #417

[timrogers]

Aha! Thanks 🏁

[nickfloyd]

For reference: #421

[octokitbot]

🎉 This PR is included in version 6.40.0 🎉

The release is available on:

• GitHub release
• npm package (@latest dist-tag)

Your semantic-release bot 📦🚀