http-party/node-portfinder

Version mismatch on `mkdirp` between `package.json` and `package-lock.json`

LostInBrittany opened this issue · 1 comments

Hi!

I see that in PR #101 you bumped-up the version of mkdirp to 0.5.5 which in turn updates minimist to 1.2.5
which addresses https://www.npmjs.com/advisories/1179

Problem is that this PR only updated package-lock.json and not package.json that remains at 0.5.1. As package.json still depends on mkdirp 0.5.1, when we get node-portfinder as a dependency, we still get an old version of minimalist.

whoa, thankyou @LostInBrittany - sorry for the delay here, shipping update immediately