Bug report

webpack currently depends on the old 0.5.1 version of "mkdirp" which depends on old vulnerable minimist package. The 0.5.x line of mkdirp from the original author is not developed any further and maintenance of this package was taken over by isaacs with the new 1.x versions.

see: https://github.com/substack/node-mkdirp/issues/166
CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7598

Please update "mkdirp" dependency to the latest 1.x version to fix this vulnerability.
.
What is the current behavior?

old "mkdirp" 0.5.1 fetches dependend package "minimist" 0.0.8 which triggers warning in security checkers blocking new builds.

If the current behavior is a bug, please provide the steps to reproduce.

What is the expected behavior?

Update dependency "mkdirp" to latest version 1.0.3 which has dropped dependency of "minimist" and does not trigger any security warnings anymore.

Other relevant information:
webpack version: 4.42.0
Node.js version: 10.16
Operating System: linux
Additional tools: