gulp-chmod

deep-assign has been deprecated and contains a known vulnerability. The maintainer of deep-assign recommends lodash.merge or lodash.merge-options as a maintained alternative. Please consider updating dependencies to use lodash.merge@4.17.11 at a minimum. https://nvd.nist.gov/vuln/detail/CVE-2019-10745

Hi, I found that two transitive dependencies are not used in your package, according to your tests. So I created a package-lock.json file that excludes the useless dependencies. Would you consider removing useless dependencies from your package, so that developers do not need to install them when they use your package? The two transitive dependencies are: string_decoder util-deprecate