<p dir="auto">Hi, could you update this dependency on the new version?</p>
<p dir="auto">Moderate        Prototype Pollution<br>
Package         minimist<br>
Patched in      &gt;=1.2.3<br>
Dependency of   webpack-dev-server [dev]<br>
Path               webpack-dev-server &gt; chokidar &gt; fsevents &gt; node-pre-gyp &gt; tar &gt; mkdirp &gt; minimist<br>
More info       <a href="https://npmjs.com/advisories/1179" rel="nofollow">https://npmjs.com/advisories/1179</a></p>
<p dir="auto">Moderate        Prototype Pollution<br>
Package         minimist<br>
Patched in      &gt;=1.2.3<br>
Dependency of   webpack [dev]<br>
Path            webpack &gt; watchpack &gt; chokidar &gt; fsevents &gt; node-pre-gyp &gt; rc &gt; minimist<br>
More info       <a href="https://npmjs.com/advisories/1179" rel="nofollow">https://npmjs.com/advisories/1179</a></p>
<h1 dir="auto">Bug report</h1>
<p dir="auto">webpack currently depends on the old 0.5.1 version of "mkdirp" which depends on old vulnerable minimist package. The 0.5.x line of mkdirp from the original author is not developed any further and maintenance of this package was taken over by isaacs with the new 1.x versions.</p>
<p dir="auto">see: <a href="https://github.com/substack/node-mkdirp/issues/166">https://github.com/substack/node-mkdirp/issues/166</a><br>
CVE: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7598" rel="nofollow">https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7598</a></p>
<p dir="auto">Please update "mkdirp" dependency to the latest 1.x version to fix this vulnerability.<br>
.<br>
<strong>What is the current behavior?</strong></p>
<p dir="auto">old "mkdirp" 0.5.1 fetches dependend package "minimist" 0.0.8 which triggers warning in security checkers blocking new builds.</p>
<p dir="auto"><strong>If the current behavior is a bug, please provide the steps to reproduce.</strong></p>






<p dir="auto"><strong>What is the expected behavior?</strong></p>
<p dir="auto">Update dependency "mkdirp" to latest version 1.0.3 which has dropped dependency of "minimist" and does not trigger any security warnings anymore.</p>


<p dir="auto"><strong>Other relevant information:</strong><br>
webpack version:  4.42.0<br>
Node.js version: 10.16<br>
Operating System: linux<br>
Additional tools:</p>