fix #4837 Update glob due to vulnerability in dep

[jb2311]

Description of the Change

The minimatch npm package version <=3.0.4 has a security vulnerability explained here: GHSA-f8q6-p94x-37v3

Mocha has the glob package 7.2.0 as a dependency, which in turn has minimatch ^3.0.4 as a dependency

This results in a high security risk warning for consumers of mocha. See #4937 for an example.

This PR changes the glob dependency to 8.1.0 which no longer depends on the insecure version of minimatch.

[linux-foundation-easycla]

The committers listed above are authorized under a signed CLA.

• ✅ login: jb2311 (cbb5669, e20dc66)

[jb2311]

@juergba this should be ready to be tested again. 2 things I have concerns about. #1 The tests referenced coffee-script, with a hyphen, but when I ran the tests, I got a "module not found error" and it looks like the hyphen package is depreciated, and mocha's package.json references "coffeescript" with no hyphen, so I updated those tests. Additionally, I got an error during linting that "eslint-plugin-n" is missing. I though it was my local setup, but it also happened when the tests ran in the CI process. Anyways, I added that package to the dev deps. Let me know if you have any questions or concerns

[juergba]

@jb2311 thank you for this PR.

We will see wether our CI tests will pass. Tbh I don't trust your package-lock.json.

Edit: looks good, I will have a closer look on coming week-end. Could you evtl. add any link about this additional lint dependency?

[coveralls]

Coverage: 94.331% (+0.002%) from 94.329% when pulling 626e19e on jb2311:upgrade-glob into 9f24d0d on mochajs:master.

[jb2311]

esline-plugin-node is no longer being maintained, so eslint-plugin-n (https://github.com/eslint-community/eslint-plugin-n) is a fork that is still active. However, I have no idea why it's erroring out without it suddenly. It happened on the first test run, when I did nothing but update the glob package https://github.com/mochajs/mocha/actions/runs/4368808387/jobs/7681675449

Edit: it looks like eslint-plugin-n is a peerDep for some packages. I was running an old version of NPM, newer versions of NPM don't require peerDeps to be referenced in the main package.json, so I removed the package.

[jb2311]

@juergba have you had a chance to take a look at this?

[juergba]

I'm not convinced completely, I'm afraid there might be some unwanted side-effects by windowsPathsNoEscape. Anyway let's do it.

[jb2311]

@juergba updated

[jb2311]

@juergba okay, I think the whitespace should be appropriate.

[juergba]

@jb2311 thank you for this PR.