vulnerability CVE-2020-28469 is introduced in workbox-cli

[ayaka-kms]

Hi, a vulnerability CVE-2020-28469 is introduced in workbox-cli via:
● workbox-cli@6.1.5 ➔ glob-watcher@5.0.5 ➔ chokidar@2.1.8 ➔ glob-parent@3.1.0

However, glob-watcher is a legacy package, which has not been maintained for about 1 years.
Is it possible to migrate glob-watcher to other package to remediate this vulnerability?

I noticed a migration record in other js repo for glob-watcher:

● in @11ty/eleventy, version 0.6.0 ➔ 0.7.0, migrate glob-watcher to chokidar via commit

Thanks.

[jeffposnick]

It looks like using chokidar 3.x directly is a good idea anyway, as glob-watcher is stuck on chokidar 2.x, and that version might have some compatibility issues with more recent node releases.