[Snyk] Fix for 1 vulnerable dependencies

[snyk-bot]

Description

This PR fixes one or more vulnerable packages in the npm dependencies of this project.
See the Snyk test report for more details.

Snyk Project: cloudfoundry-incubator/stratos:package.json

Snyk Organization: KlapTrap

Changes included in this PR

• A Snyk policy (.snyk) file, with updated settings.

Vulnerabilities that will be fixed

With a Snyk patch:

• SNYK-JS-LODASH-450202

You can read more about Snyk's upgrade and patch logic in Snyk's documentation.

Check the changes in this PR to ensure they won't cause issues with your project.

Stay secure,
The Snyk team

Note: You are seeing this because you or someone else with access to this repository has authorised Snyk to open Fix PRs. To review the settings for this Snyk project please go to the project settings page.

[cfdreddbot]

❌ Hey snyk-bot!

All pull request submitters and commit authors must have a Contributor License Agreement (CLA). Click here for details on the CLA process.

The following github user @snyk-bot is not covered by a CLA.

After the CLA process is complete, this pull request will need to be closed & reopened. DreddBot will then validate the CLA(s).

[codecov]

Codecov Report

Merging #3691 into v2-master will not change coverage.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           v2-master    #3691   +/-   ##
==========================================
  Coverage      51.42%   51.42%           
==========================================
  Files            725      725           
  Lines          20567    20567           
  Branches        3682     3682           
==========================================
  Hits           10577    10577           
  Misses          9990     9990

[richard-cox]

I'm not 100% sure what snyk is trying to do here. We've locked ngrx-store-localstore to a version with a fix in (btroncone/ngrx-store-localstorage#126 is still open) and it's adding itself into our npm process on prepare

prepare: Run both BEFORE the package is packed and published, on local npm install without any arguments, and when installing git dependencies (See below). This is run AFTER prepublish, but BEFORE prepublishOnly

Unless there are any objections I'll close @nwmac @KlapTrap

[nwmac]

No. Don't want Snyk doing this