mem security warning

[sturdynut]

This is to bring the mem security warning to attention. After following the yarn.lock it appears that this mem dependency is coming from the version of yargs that eslint-find-rules is using.

Here's the chain of dependencies that lead to the insecure package.

eslint-find-rules → yargs (v8.0.1)
yargs (v8.0.1) → os-locale (v2.0.0)
os-locale (v2.0.0) → mem (v^1.1.0")

I've submitted a PR to upgrade their version of yargs to the latest which should remove mem as a dependency entirely.

We should be able to upgrade our version of eslint-find-rules once this is merged and a new version is released.

[randycoulman]

eslint-find-rules is a dev-only dependency for this project, so not a huge issue for us, and certainly not an issue for our users. Thanks for bringing it up!