Node.js minimist security issue even with v1.2.5

Question

After installing express-handlebars and running "npm audit", I'm getting a "low severity vulnerability" warning for minimist. npm says: "Patched in >=0.2.1 <1.0.0 || >=1.2.3"

https://npmjs.com/advisories/1179

So I upgraded to minimist v1.2.5 but I'm still getting the security warning.

• Windows 10 pro
• node: v13.11.0
• npm: v6.14.3
• express: v4.17.1
• express-handlebars: v4.7.3
• minimist: v1.2.5

Answer 1

It's a known issue at the moment:

• https://github.com/substack/minimist/issues/145
• https://github.com/facebook/create-react-app/issues/8663