Security alert on minimist before 1.2.2

[shun-tak]

There is a security alert on dependency minimist. It is recommended to update to version 1.2.2 or later.

However, it is a dependency on truffle. Although I updated the truffle to latest 5.1.17, truffle still uses [email protected] and old [email protected].

dependency information from npm list

[email protected]
└─ [email protected]
   └─ [email protected]
      └─ [email protected]

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7598
• https://snyk.io/vuln/SNYK-JS-MINIMIST-559764