chore: update eslint-utils to 1.4.2

[nikoladev]

Description

From npm's security advisory:

Versions of eslint-utils >=1.2.0 or <1.4.1 are vulnerable to Arbitrary Code Execution. The getStaticValue does not properly sanitize user input allowing attackers to supply malicious input that executes arbitrary code during the linting process. The getStringIfConstant and getPropertyName functions are not affected.

More info:

• GHSA-3gx7-xhv7-5mx3
• https://eslint.org/blog/2019/08/eslint-v6.2.1-released

[nikoladev]

Oops, I see that I've given the branch an incorrect name! This fix updated eslint-utils to 1.4.2, to be clear.

[wardpeet]

Hey, changing yarn.lock doesn't really fixes this issue. It will be fixed for yarn users that use this repository but it won't be used by people that install gatsby and create an application with it.

We don't have eslint-utils specified anywhere except our dependencies so we can't really solve this problem. We'll need to upgrade to eslint 6 which we cant as we suport node 8.0 and eslint 6 needs 8.10.0 or something

Edit, this will actually work, don't mind my comments. Thanks for updating!

[wardpeet]

Looks good to me, thanks!