class-validator has released 0.14.0 as another patch to CVE-2019-18413 (link). This is related to #1019.

Even though we are already passing forbidUnknownValues: true (link), auditing tools are still flagging javascript-obfuscator for having a vulnerable dependency.