Twenty Twenty: Usage of outdated package-lock.json poses security risk

[JeffMatson]

The current version of Twenty Twenty (1.2) contains a package-lock.json file which uses a very old version of minimist which has a known security vulnerability (see: CVE-2020-7598).

Not a valid HackerOne report per policy:

Vulnerabilities in Composer/NPM devDependencies, unless there's a practical way to exploit it remotely.

While not likely to get exploited in the wild unless someone were to push their node_modules to a live site after running tests/builds, it will cause security alerts to go off if monitored.

Attached is a regenerated lockfile which should resolve any issues there.

[JeffMatson]

Lockfile regenerated using the current package.json file.

[whyisjake]

Duplicate of #49768.

Thanks for the ticket @JeffMatson. This was resolved in [47925].