NPM audit reports vulerabilities

[DDavidkov]

mapbox-gl-js version: 1.12.0 (but doesn't really matter)
mapbox-gl-draw version: 1.2.0

Steps to Trigger Behavior

1. Init an npm repo using "npm init" and pressing "Enter" for all prompts
2. Run "npm i @mapbox/mapbox-gl-draw"
3. Run "npm audit"

Expected Behavior

0 vulnerabilities reported.

Actual Behavior

2 vulnerabilities reported:

Additional info

Both vulnerabilities are caused by the minimist package using 1.2.0 version in which there is a low vulnerability. It is fixed in the newest version of minimist.

To fix the "@mapbox/mapbox-gl-draw > @mapbox/geojson-extent > @mapbox/geojson-coords > geojson-flatten > minimist" all you need to do is to bump the @mapbox/geojson-extent version to 1.0.0 and every library down the path is already updated to version without the vulnerability.

For the "@mapbox/mapbox-gl-draw > @mapbox/geojsonhint > minimist" path, @mapbox/geojsonhint has already updated the minimist version to a non-vulnerable version, but the change isn't released yet. There is an issue about that, but there is no activity since May of this year.

I know that this vulnerability can't really be exploited from the mapbox-draw-gl package, but my company has a blanket "no vulnerabilities" policy, so if you can update those packages, it will be greatly appreciated.