Update packages to pass npm audit

[ntwb]

Description

npm v6 includes a new audit tool, when running npm install currently the following warning is displayed:

[!] 31 vulnerabilities found [27629 packages audited]
    Severity: 5 Low | 21 Moderate | 5 High
    Run `npm audit` for more detail

After applying the patch here in this PR the warnings are gone:

[+] no known vulnerabilities found [542 packages audited]

Notes:

• codecov, webpack, and webpack-cli are version bumps

• node-sass changes from v4.7.2 to v4.7.0, this is due to node-sass > v4.7.1 locking down the request library to ~2.79.0 which includes a vulnerable hoek package, see https://nodesecurity.io/advisories/566. It also uses the v4.7.0 release from GitHub rather than npmjs.com because v4.7.0 is not published to npmjs.com. This issue will not be resolved by node-sass until v5.0.0 is released in a few weeks time when as part of that release Node.js v4 support will be dropped.

• The latest release of fsevents is added as in optionalDependencies, this allows the version of hoek shipped in webpack to be overridden, it is also beneficial as Travis CI will no longer try to install fsevents which removes another warning, fsevents is a macOS only package, this change should also be made for core, see https://core.trac.wordpress.org/changeset/39368

How has this been tested?

Running npm i

Screenshots

Types of changes

Build tools.

Checklist:

• My code is tested.
• My code follows the WordPress code style.
• My code follows the accessibility standards.
• My code has proper inline documentation.

[gziolo]

npm audit

                   === npm audit security report ===                        

[+] no known vulnerabilities found
Packages audited: 43213 (41454 dev, 603 optional)

🎉

[gziolo]

Why −16,565 lines were removed in the lock file? I mean, it's nice but also puzzling.

[gziolo]

Yes, something went wrong with the lock file. When I run npm i locally I see tons of changes.

[gziolo]

Needs rebase after #6758 got merged 😅

[pento]

It's interesting that npm audit says to upgrade node-sass to 4.9.0 to resolve the hoek issue, when that won't work. 🙃

[ntwb]

I've no idea why the lock file was the way it was, b311304 is +/- ~5000 and looks much saner

[gziolo]

Yes, all good now, I don't see any local changes after npm i 👍