[Snyk] Fix for 5 vulnerabilities

[adamlaska]

Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

• packages/bitcore-build/package.json
• packages/bitcore-build/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

	Issue
	Inefficient Algorithmic Complexity SNYK-JS-JSYAML-17900054
	Infinite loop SNYK-JS-TAR-17909068
	Incorrect Type Conversion or Cast SNYK-JS-TAR-17909104
	Allocation of Resources Without Limits or Throttling SNYK-JS-TAR-17909152
	Uncaught Exception SNYK-JS-TAR-17909225

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Allocation of Resources Without Limits or Throttling
🦉 Uncaught Exception

[adamlaska]

This upgrade includes major versions for gulp, mocha, and gulp-mocha, introducing significant breaking changes that require developer action. All three upgrades are high-risk and interconnected.

gulp@4.0.2 → gulp@5.0.0 (High Risk)

This major upgrade introduces several breaking changes to the build system.

Key Changes:

• Node.js Requirement: Support for Node.js versions below 10.13 has been dropped.
• Task Composition: gulp.series() and gulp.parallel() are now required for all task composition. The older 3-argument gulp.task('name', ['dep'], fn) syntax has been removed.
• Stream Encoding: Streams now default to UTF-8. This can corrupt binary files like fonts and images. To fix this, you must add {encoding: false} to gulp.src() for binary assets.
• gulp.watch API: The watch API no longer accepts string or array tasks and now only works with functions.
• CLI Changes: The --require flag has been renamed to --preload.

mocha@6.2.2 → mocha@10.6.0 (High Risk)

This is a significant jump across multiple major versions (v7, v8, v9, v10) with substantial breaking changes.

Key Changes:

• Node.js Requirement: Support for Node.js versions below v10.12.0 has been dropped (v8.0.0), and support for v10.x was dropped in v9.0.0.
• Configuration: The mocha.opts file is no longer supported and must be replaced with a configuration file like .mocharc.js or package.json.
• ESM Support: Mocha is now ESM-first, meaning it attempts to load test files using import() before falling back to require(). This may impact how test files are structured and loaded.
• API Removal: The this.enableTimeout() function has been removed from the test context.

gulp-mocha@7.0.2 → gulp-mocha@9.0.0 (High Risk)

This upgrade is necessary to support the newer versions of Gulp and Mocha.

Key Changes:

• Mocha Integration: The plugin now spawns the mocha binary instead of using its programmatic API. This means options should be passed as camelCased CLI flags.
• Dependency Alignment: These versions are required for compatibility with the breaking changes in Mocha v7 through v9.

Recommendation: These upgrades will almost certainly break your existing build and test setup. A careful migration is required. Developers should:

1. Update the Node.js version in the environment to at least v10.13.0 (though v12+ is safer given Mocha's requirements).
2. Refactor the gulpfile.js to use gulp.series() and gulp.parallel() for task composition.
3. Add {encoding: false} to any gulp.src() streams that handle binary files.
4. Replace `mocha

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

[sourcery-ai]

Sorry @adamlaska, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.