ISSUE-626 Upgrade transitive dep eslint-utils to fix vulnerability

[samuelneff]

Resolves critical security vulnerability in eslint-utils, dependency of eslint.

#626

Checklist

• Latest code from master has been merged into the pull request branch
• Honors the seven code virtues
  • Working, as opposed to incomplete
  • Unique, as opposed to duplicated
  • Simple, as opposed to complicated
  • Clear, as opposed to puzzling
  • Easy, as opposed to difficult
  • Developed, as opposed to primitive
  • Brief, as opposed to chatty
• Code is camelCased
• No commented out code (if required, place // TODO above with explanation)
• No linting issues
• Automated tests exist and pass
• Build is successful (npm run build)
• Works in IE 11, Chrome, Firefox, and Edge

Thanks!

❤️

[coveralls]

Coverage remained the same at 91.525% when pulling f03ee4f on samuelneff:issue-626-eslint-util-vulnerability into e371105 on coryhouse:master.

[nickytonline]

This brings up a good point. I know in the past we said Greenkeeper was more annoying than helpful, but I've been using Dependabot for dependency updates and even automated the process with Cypress. We could potentially so the same here or at a minimum let Dependabot create PRs for security fixes.

For those interested, I wrote a post about automating dependency updates, Update Dependencies with Dependabot, Cypress and Netlify. We could do something similar for react-slingshot.

[coryhouse]

I worry about the amount of noise it would create due to such frequent releases. Since this is dev tooling, most the warnings are irrelevant anyway. It's the warnings in the prod deps that actually matter, and those are rare.

That said, I'd be open to a PR to try it.

[samuelneff]

@coryhouse fwiw, my work would not allow us use a project with warnings like the one covered here, even if it is an irrelevant dev dependency.

I wouldn't necessarily update all dependencies all the time as soon as they're available, but addressing security vulnerabilities would be good as they come up and updating the rest of the dependencies on a semi-regular scheduled basis.