title: What exactly do I do about gulp 4.0.2 dependency vulnerabilities?
body: <p>In my <code>package.json</code> I have listed gulp as one of my dependencies.</p>
  <pre class="lang-json prettyprint-override"><code>{
      &quot;name&quot;: &quot;myproject&quot;,
      &quot;devDependencies&quot;: {
          &quot;gulp&quot;: &quot;^4.0.2&quot;
          // other stuff
      }
  }
  </code></pre>
  <p>When I run <code>npm i</code> I get a message there are moderate security vulnerabilities. So I do <code>npm audit</code> and I get this</p>
  <pre><code>                       === npm audit security report ===                        
  
  
                                   Manual Review                                  
               Some vulnerabilities require your attention to resolve             
                                                                                  
            Visit https://go.npm.me/audit-guide for additional guidance           
  
  
    Moderate        Regular expression denial of service                          
  
    Package         glob-parent                                                   
  
    Patched in      &gt;=5.1.2                                                       
  
    Dependency of   gulp [dev]                                                    
  
    Path            gulp &gt; glob-watcher &gt; chokidar &gt; glob-parent
  
    More info       https://npmjs.com/advisories/1751
  
  
    Moderate        Regular expression denial of service
  
    Package         glob-parent
  
    Patched in      &gt;=5.1.2
  
    Dependency of   gulp [dev]
  
    Path            gulp &gt; vinyl-fs &gt; glob-stream &gt; glob-parent
  
    More info       https://npmjs.com/advisories/1751
  
  found 2 moderate severity vulnerabilities in 751 scanned packages
    2 vulnerabilities require manual review. See the full report for details.
  </code></pre>
  <p>So then I thought it was all a matter of changing the version of gulp to the highest version where it is (probably) patched. But it seems that this is already the highest version, so what do I do about the vulnerability?</p>