Bump cheerio to @1.0.0-rc.11

[vinodkumarsharma276]

Due to recent security vulnerability in nth-checkv1.2.0 which is fetched transitively from enzyme --> cheerio --> css-select --> .... --> nth-checkv1.2.0.

cherrio@1.0.0-rc.11 removes dependency of css-select which ultimately removes dependency of nth-check

[vinodkumarsharma276]

Hi @ljharb / @lelandrichardson @koba04 @nfcampos ,
Can someone take a look at this PR and approve. This will fix security vulnerability with nth-check@1.2.0 which is downloaded transitively using enzyme.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.62%. Comparing base (3d286a4) to head (6c63667).
⚠️ Report is 65 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2561      +/-   ##
==========================================
- Coverage   96.31%   94.62%   -1.69%     
==========================================
  Files          49       32      -17     
  Lines        4207     2717    -1490     
  Branches     1130      777     -353     
==========================================
- Hits         4052     2571    -1481     
+ Misses        155      146       -9     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ljharb]

It's worth noting that this is not actually a vulnerability, it's a false positive, at least for enzyme's use case.

[ljharb]

Suggested change

	"cheerio": "=1.0.0-rc.11",
	"cheerio": "^1.0.0-rc.11",

i suspect this will break tests, which is why it's pinned to rc3.

[ChristopherChudzicki]

FYI: People (me included!) have been having problems with cheerio 1.0.0-rc.11 see ... cheeriojs/cheerio#2545. It's not clear to me whether this is actually a cheerio issue, or something a bit wonky with mine and others webpack/babel configs.

I mention it here because I, like others in that thread, encountered it through the dependency from enzyme.

[tbowmo]

cheerio 1.0.0 is now released, so perhaps (if anyone ever comes around) it should be updated to that package

[ljharb]

Due to engine requirements, we may never be able to update to it. We’re far more likely to drop the render API.