[adapter-node-http] Upgrade nock version to 12.0.3+ to fix Critical CVE-2020-7598

[mleneveut]

Description

There is a CVE-2020-7598 on minimist, which is fixed in mkdirp 0.5.3 or 1.x. Adapter-node-http uses nock@11.7.2 :
https://github.com/Netflix/pollyjs/blob/master/packages/%40pollyjs/adapter-node-http/package.json#L49

Could we upgrade nock@12.0.3 which removes mkdirp and so will fix the CVE ?

I don't know if this CVE is exploitable but it fails in our security scanner (Anchore) and our CISO is strict about that, no matter what.

Relevant Links

https://nvd.nist.gov/vuln/detail/CVE-2020-7598

Environment

Node.js v12.16.1
linux 4.4.0-176-generic
npm  6.13.4
yarn  1.22.4

[mleneveut]

Node and npm are fixing their dependencies here :

nodejs/node#32296
npm/cli@e111676

[offirgolan]

Thanks for reporting this issue. I'll take a look first thing next week into upgrading nock.

[offirgolan]

Released with v4.0.4

[mleneveut]

Thanks a lot for your quick answer !