[Security] Bump static-eval from 2.0.0 to 2.0.2

[dependabot-preview[bot]]

Bumps static-eval from 2.0.0 to 2.0.2. This update includes security fixes.

Vulnerabilities fixed

*Sourced from [The npm Advisory Database](https://npmjs.com/advisories/758).* > **Sandbox Breakout / Arbitrary Code Execution** > Versions of `static-eval`prior to 2.0.2 pass untrusted user input directly to the global function constructor, resulting in an arbitrary code execution vulnerability when user input is parsed via the package. > > ## Proof of concept > ``` > var evaluate = require('static-eval'); > var parse = require('esprima').parse; > > var src = process.argv[2]; > var payload = '(function({x}){return x.constructor})({x:"".sub})("console.log(process.env)")()' > var ast = parse(payload).body[0].expression; > console.log(evaluate(ast, {x:1})); > ``` > > Affected versions: <=2.0.1

Commits

- [`83beb55`](https://github.com/browserify/static-eval/commit/83beb55a527532b611a49fb19c3b488c23f88a2d) 2.0.2 - [`3fe509f`](https://github.com/browserify/static-eval/commit/3fe509fd98c0c8dbf73d1a96cd6a0d652759cb99) Merge pull request [#23](https://github-redirect.dependabot.com/substack/static-eval/issues/23) from cript0nauta/master - [`a5547bf`](https://github.com/browserify/static-eval/commit/a5547bf00a3053e06c995fc3818289490cb4838b) Fix a bug in the sandbox breakout fix - [`42f6914`](https://github.com/browserify/static-eval/commit/42f69147970cc33af8a682df45d7272fcd1cddbd) Merge pull request [#22](https://github-redirect.dependabot.com/substack/static-eval/issues/22) from goto-bus-stop/warn - [`5d5dc2d`](https://github.com/browserify/static-eval/commit/5d5dc2d63de66a22f95f91615d7a56ed41f680f2) 2.0.1 - [`a56a139`](https://github.com/browserify/static-eval/commit/a56a139dd1290e958b9da44fd79c63bf2eabc23f) explicitly mention security caveats - [`32f8efd`](https://github.com/browserify/static-eval/commit/32f8efd072625e267aa7237d2daff35738c50d2a) Fix sandbox breakout vulnerability - See full diff in [compare view](https://github.com/substack/static-eval/compare/2.0.0...v2.0.2)

Maintainer changes

This version was pushed to npm by [goto-bus-stop](https://www.npmjs.com/~goto-bus-stop), a new releaser for static-eval since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will not automatically merge this PR because it includes a security patch update to a production dependency.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) - `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language - `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language - `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language - `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language - `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com): - Update frequency (including time of day and day of week) - Automerge options (never/patch/minor, and dev/runtime dependencies) - Pull request limits (per update run and/or open at any time) - Out-of-range updates (receive only lockfile updates, if desired) - Security updates (receive only security updates, if desired) Finally, you can contact us by mentioning @dependabot.

[dependabot-preview[bot]]

Superseded by #660.