Run npm audit fix to get rid of vulnerabilities

[gziolo]

Before

$ npm install

audited 135059 packages in 46.027s
found 2033 vulnerabilities (2028 moderate, 5 high)
  run `npm audit fix` to fix them, or `npm audit` for details

After

$ npm audit fix

+ lerna@3.11.1
+ @babel/core@7.2.2
+ @babel/traverse@7.2.3
+ lodash@4.17.11
added 99 packages from 74 contributors, removed 26 packages, updated 93 packages and moved 5 packages in 26.426s
fixed 1149 of 2033 vulnerabilities in 135059 scanned packages
  884 vulnerabilities required manual review and could not be updated

$ npm install

audited 139596 packages in 42.954s
found 0 vulnerabilities

[gziolo]

I'm also looking whether we should update lodash and @babel/* in all packages to the latest versions.

[aduth]

I'm also looking whether we should update lodash and @babel/* in all packages to the latest versions.

To this point, we updated the one instance of lodash here, but:

• What about the many other instances of lodash@4.17.10 which (still) exist as dependencies of individual modules?
• Which of these, if any, should be tied explicitly to the version of Lodash shipped with core? (4.17.11)

[gziolo]

I updated all instances of lodash to align with the root package.json file, and I did version bump for all @babel/* packages to prevent the same vulnerabilities to be the thing when packages are installed from npm.

See cb965b4

[nerrad]

• Will CHANGELOG.md updates be needed for something like this?
• Will there need to be a patch submitted to https://core.trac.wordpress.org for upping the lodash version in wp core (or is that what @aduth's comment above already addresses?)

[gziolo]

Will there need to be a patch submitted to https://core.trac.wordpress.org for upping the lodash version in wp core

It was already bumped in core according to linked file from trunk.

• Will CHANGELOG.md updates be needed for something like this?

I don't know. There are no breaking changes introduced. We should finally clarify what minor version bump of dependency means in the context of the changelog.

[dmsnell]

👍 thanks