title: Github high severity security vulnerabilities: GHSA-7fhm-mqm4-2wp7 with a Node.js app
body: <p>After adding nodemon to devDependencies on my node.js app, i get a Security Alert on GitHub:</p>
  
  <blockquote>
    <p>moderate severity
    Vulnerable versions: &lt; 1.2.2
    Patched version: 1.2.2
    There are high severity security vulnerabilities in two of ESLints dependencies:
    - acorn
    - minimist</p>
    
    <p>The releases 1.8.3 and lower of svjsl (JSLib-npm) are vulnerable, but only if installed in a developer environment. A patch has been released (v1.8.4) which fixes these vulnerabilities.</p>
    
    <p>Identifiers:</p>
    
    <p>CVE-2020-7598
    SNYK-JS-ACORN-559469 (doesn&#39;t have a CVE identifier)</p>
  </blockquote>
  
  <p>My package.json :</p>
  
  <pre><code>{
        "name": "web-server",
        "version": "1.0.0",
        "description": "",
        "main": "app.js",
        "scripts": {
          "start": "node src/app.js",
          "dev": "nodemon src/app.js -e js,hbs"
        },
        "keywords": [],
        "author": "",
        "license": "ISC",
        "dependencies": {
          "express": "^4.17.1",
          "hbs": "^4.1.0"
        },
        "devDependencies": {
          "nodemon": "^2.0.2"
        }
      }
  </code></pre>
  
  <p><strong>I don't know exactly what should i do or should i provide more information/code about my app.</strong></p>
  
  <p>Github repo: <a href="https://github.com/badrddinb/simple-weather-website" rel="nofollow noreferrer">https://github.com/badrddinb/simple-weather-website</a></p>