Bump mocha from 2.5.3 to 6.1.4

[dependabot-preview]

Bumps mocha from 2.5.3 to 6.1.4.

Release notes

Sourced from mocha's releases.

v6.1.4

6.1.4 / 2019-04-18

🔒 Security Fixes

• #3877: Upgrade js-yaml, addressing code injection vulnerability ([@​bjornstar](https://github.com/bjornstar))

v6.1.3

6.1.3 / 2019-04-11

🐛 Fixes

• #3863: Fix yargs-related global scope pollution ([@​inukshuk](https://github.com/inukshuk))
• #3869: Fix failure when installed w/ pnpm ([@​boneskull](https://github.com/boneskull))

v6.1.2

6.1.2 / 2019-04-08

🐛 Fixes

• #3867: Re-publish v6.1.1 from POSIX OS to avoid dropped executable flags ([@​boneskull](https://github.com/boneskull))

v6.1.1

6.1.1 / 2019-04-07

🐛 Fixes

• Fix Windows End-of-Line publishing issue

v6.1.0

6.1.0 / 2019-04-07

🔒 Security Fixes

• #3845: Update dependency "js-yaml" to v3.13.0 per npm security advisory ([@​plroebuck](https://github.com/plroebuck))

🎉 Enhancements

• #3766: Make reporter constructor support optional options parameter ([@​plroebuck](https://github.com/plroebuck))
• #3760: Add support for config files with .jsonc extension ([@​sstephant](https://github.com/sstephant))

📠 Deprecations

These are soft-deprecated, and will emit a warning upon use. Support will be removed in (likely) the next major version of Mocha:

• #3719: Deprecate this.skip() for "after all" hooks ([@​juergba](https://github.com/juergba))

🐛 Fixes

• #3829: Use cwd-relative pathname to load config file ([@​plroebuck](https://github.com/plroebuck))

... (truncated)

Changelog

Sourced from mocha's changelog.

6.1.4 / 2019-04-18

🔒 Security Fixes

• #3877: Upgrade js-yaml, addressing code injection vulnerability ([@​bjornstar](https://github.com/bjornstar))

6.1.3 / 2019-04-11

🐛 Fixes

• #3863: Fix yargs-related global scope pollution ([@​inukshuk](https://github.com/inukshuk))
• #3869: Fix failure when installed w/ pnpm ([@​boneskull](https://github.com/boneskull))

6.1.2 / 2019-04-08

🐛 Fixes

• #3867: Re-publish v6.1.1 from POSIX OS to avoid dropped executable flags ([@​boneskull](https://github.com/boneskull))

6.1.1 / 2019-04-07

🐛 Fixes

• #3866: Fix Windows End-of-Line publishing issue ([@​juergba](https://github.com/juergba) & [@​cspotcode](https://github.com/cspotcode))

6.1.0 / 2019-04-07

🔒 Security Fixes

• #3845: Update dependency "js-yaml" to v3.13.0 per npm security advisory ([@​plroebuck](https://github.com/plroebuck))

🎉 Enhancements

• #3766: Make reporter constructor support optional options parameter ([@​plroebuck](https://github.com/plroebuck))
• #3760: Add support for config files with .jsonc extension ([@​sstephant](https://github.com/sstephant))

📠 Deprecations

These are soft-deprecated, and will emit a warning upon use. Support will be removed in (likely) the next major version of Mocha:

• #3719: Deprecate this.skip() for "after all" hooks ([@​juergba](https://github.com/juergba))

🐛 Fixes

• #3829: Use cwd-relative pathname to load config file ([@​plroebuck](https://github.com/plroebuck))
• #3745: Fix async calls of this.skip() in "before each" hooks ([@​juergba](https://github.com/juergba))
• #3669: Enable --allow-uncaught for uncaught exceptions thrown inside hooks ([@​givanse](https://github.com/givanse))

and some regressions:

... (truncated)

Commits

• 31c019e Release v6.1.4
• c3d241e update CHANGELOG.md for v6.1.4 [ci skip]
• 0d9d4a3 Update js-yaml from 3.13.0 to 3.13.1 (#3877)
• f1fe632 Release v6.1.3
• ae3d53f update CHANGELOG for v6.1.3 [ci skip]
• e73941a upgrade node-environment-flags; closes #3868
• 5121211 Do not pass argv twice
• f05a58f Fix yargs global pollution
• 86cd699 Release v6.1.2
• 2e8f31f update CHANGELOG for v6.1.2
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will not automatically merge this PR because it includes a major update to a production dependency.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot ignore this [patch|minor|major] version will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

[BinaryTiger]

Any chances that this will be merged? There are 1 critical, 1 high and 1 low vulnerability that would be fixed by this. The current version of mocha is 3 years old.

[Turbo87]

yes, we're getting closer to being able to merge this

[BinaryTiger]

Perfect, thank you very much!

[rwjblue]

@Turbo87 - Is there a tracking issue with the remaining tasks?

[Turbo87]

now that the implicit async stuff is gone, I think all that remains is updating the dep and trying it out on real apps/addons. I don't see any other blockers.

[dependabot-preview]

Dependabot tried to update this pull request, but something went wrong. We're looking into it, but in the meantime you can retry the update by commenting @dependabot rebase.

[dependabot-preview]

Superseded by #400.