Npm package Vulnerability in tree-kill for windows machines

[arash-a2k]

Description

npm dependency Volnerability
expo-cli > @expo/xdl > tree-kill

Expected Behavior

Not having Volnerable dependencies

│ High          │ Command Injection                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ tree-kill                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=1.2.2                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ expo-cli                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ expo-cli > @expo/xdl > tree-kill                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1432       

[brentvatne]

i suggest reading the advisory, this is indeed a vulnerability in certain situations (if you run this on a server and pass in arbitrary user generated content to tree-kill) but in the context that expo-cli runs in it is not. that said, this was an easy fix so i went ahead and updated it, it'll go out in the next release