Replace optimist or otherwise avoid its vulnerability about node-static

[brettz9]

@debrice: Yes, thank you, but not every project is using Yarn.

[typehorror]

@brettz9 You can enforce the right version of minimist if you use yarn by using the resolutions feature in your package.json file. I've successfully removed the vulnerability through this commit

Edited to point out that this solution will not work as of today if you use npm

[dscham]

Bump

+1

[Jahmilli]

I might be mistaken but I found that installing npm-force-resolutions as a dev dependency and adding the following into the package.json

  "resolutions": {
    "minimist": "^1.2.5",
  },

as well as the following script into my package.json: "preinstall": "npx npm-force-resolutions"
By then running npm run preinstall and then npm i it seemed to remove the audit issue around using minimist.

[dscham]

Looks like it's dead, last commit on master in 2018? Is there still somebody to merge? Then I maybe make a fork with a fix.

[rfossella]

Is installing npm-force-resolutions as a dev dependency still the only (recommended) solution to the optimist/minimist issue?

npm audit

Low             Prototype Pollution
  Package         minimist
  Patched in      >=0.2.1 <1.0.0 || >=1.2.3
  Dependency of   optimist
  Path            optimist > minimist
  More info       https://npmjs.com/advisories/1179

[brettz9]

Closed by #227.