resolve CVE-2020-7608: Prototype Pollution in yargs-parser (GHSA-p9pc-299p-vxgp)
resolve CVE-2020-28469: Regular expression denial of service in glob-parent (GHSA-ww39-953v-wcq6)
add automation workflows
transitive dependencies blocking dependabot
```
flow-copy-source@2.0.9 requires yargs-parser@^16.1.0 via a transitive dependency on yargs@15.0.2
flow-coverage-report@0.8.0 requires yargs-parser@^20.2.2 via a transitive dependency on yargs@16.2.0
```
Fixing disappearing transitive dependencies
auditing caused some transitive dependencies to disappear, as their dependent packages no longer relied on them. this broke testing. re-added manually as devDepenencies to fix testing:
full list
- `jmespath`
- `xml2js`
security risks fixed
old
yargs-parser
```zsh
yarn why v1.22.5
[1/4] π€ Why do we have the module "yargs-parser"...?
[2/4] π Initialising dependency graph...
[3/4] π Finding dependency...
[4/4] π‘ Calculating file sizes...
=> Found "yargs-parser@18.1.3"
info Reasons this module exists
- "yargs" depends on it
- Hoisted from "yargs#yargs-parser"
info Disk size without dependencies: "92KB"
info Disk size with unique dependencies: "128KB"
info Disk size with transitive dependencies: "128KB"
info Number of shared dependencies: 2
=> Found "flow-copy-source#yargs-parser@16.1.0"
info Reasons this module exists
- "flow-copy-source#yargs" depends on it
- Hoisted from "flow-copy-source#yargs#yargs-parser"
=> Found "flow-coverage-report#yargs-parser@20.2.7"
info Reasons this module exists
- "flow-coverage-report#yargs" depends on it
- Hoisted from "flow-coverage-report#yargs#yargs-parser"
info Disk size without dependencies: "156KB"
info Disk size with unique dependencies: "156KB"
info Disk size with transitive dependencies: "156KB"
info Number of shared dependencies: 0
β¨ Done in 0.63s.
```
glob-parent
```zsh
yarn why v1.22.5
[1/4] π€ Why do we have the module "glob-parent"...?
[2/4] π Initialising dependency graph...
[3/4] π Finding dependency...
[4/4] π‘ Calculating file sizes...
=> Found "glob-parent@5.1.1"
info Has been hoisted to "glob-parent"
info Reasons this module exists
- Hoisted from "eslint#glob-parent"
- Hoisted from "flow-coverage-report#flow-annotation-check#eslint#glob-parent"
info Disk size without dependencies: "28KB"
info Disk size with unique dependencies: "48KB"
info Disk size with transitive dependencies: "64KB"
info Number of shared dependencies: 2
=> Found "chokidar#glob-parent@3.1.0"
info This module exists because "@babel#cli#chokidar" depends on it.
=> Found "flow-copy-source#glob-parent@5.1.0"
info Reasons this module exists
- "flow-copy-source#chokidar" depends on it
- Hoisted from "flow-copy-source#chokidar#glob-parent"
β¨ Done in 0.60s.
```
fixed
glob-parent
```zsh
yarn why v1.22.5
[1/4] π€ Why do we have the module "glob-parent"...?
[2/4] π Initialising dependency graph...
[3/4] π Finding dependency...
[4/4] π‘ Calculating file sizes...
=> Found "glob-parent@5.1.2"
info Reasons this module exists
- "eslint" depends on it
- Hoisted from "eslint#glob-parent"
- Hoisted from "flow-copy-source#chokidar#glob-parent"
- Hoisted from "flow-coverage-report#flow-annotation-check#eslint#glob-parent"
info Disk size without dependencies: "28KB"
info Disk size with unique dependencies: "48KB"
info Disk size with transitive dependencies: "64KB"
info Number of shared dependencies: 1
β¨ Done in 0.75s.
```
yargs-parser
```zsh
yarn why v1.22.5
[1/4] π€ Why do we have the module "yargs-parser"...?
[2/4] π Initialising dependency graph...
[3/4] π Finding dependency...
[4/4] π‘ Calculating file sizes...
=> Found "yargs-parser@18.1.3"
info Reasons this module exists
- "yargs" depends on it
- Hoisted from "yargs#yargs-parser"
info Disk size without dependencies: "92KB"
info Disk size with unique dependencies: "128KB"
info Disk size with transitive dependencies: "128KB"
info Number of shared dependencies: 2
=> Found "flow-coverage-report#yargs-parser@20.2.7"
info Reasons this module exists
- "flow-coverage-report#yargs" depends on it
- Hoisted from "flow-coverage-report#yargs#yargs-parser"
info Disk size without dependencies: "156KB"
info Disk size with unique dependencies: "156KB"
info Disk size with transitive dependencies: "156KB"
info Number of shared dependencies: 0
β¨ Done in 0.66s.
```
Summary
What does this PR do?
transitive dependencies blocking dependabot
``` flow-copy-source@2.0.9 requires yargs-parser@^16.1.0 via a transitive dependency on yargs@15.0.2 flow-coverage-report@0.8.0 requires yargs-parser@^20.2.2 via a transitive dependency on yargs@16.2.0 ```Fixing disappearing transitive dependencies
auditing caused some transitive dependencies to disappear, as their dependent packages no longer relied on them. this broke testing. re-added manually as devDepenencies to fix testing:
full list
- `jmespath` - `xml2js`security risks fixed
old
yargs-parser
```zsh yarn why v1.22.5 [1/4] π€ Why do we have the module "yargs-parser"...? [2/4] π Initialising dependency graph... [3/4] π Finding dependency... [4/4] π‘ Calculating file sizes... => Found "yargs-parser@18.1.3" info Reasons this module exists - "yargs" depends on it - Hoisted from "yargs#yargs-parser" info Disk size without dependencies: "92KB" info Disk size with unique dependencies: "128KB" info Disk size with transitive dependencies: "128KB" info Number of shared dependencies: 2 => Found "flow-copy-source#yargs-parser@16.1.0" info Reasons this module exists - "flow-copy-source#yargs" depends on it - Hoisted from "flow-copy-source#yargs#yargs-parser" => Found "flow-coverage-report#yargs-parser@20.2.7" info Reasons this module exists - "flow-coverage-report#yargs" depends on it - Hoisted from "flow-coverage-report#yargs#yargs-parser" info Disk size without dependencies: "156KB" info Disk size with unique dependencies: "156KB" info Disk size with transitive dependencies: "156KB" info Number of shared dependencies: 0 β¨ Done in 0.63s. ```glob-parent
```zsh yarn why v1.22.5 [1/4] π€ Why do we have the module "glob-parent"...? [2/4] π Initialising dependency graph... [3/4] π Finding dependency... [4/4] π‘ Calculating file sizes... => Found "glob-parent@5.1.1" info Has been hoisted to "glob-parent" info Reasons this module exists - Hoisted from "eslint#glob-parent" - Hoisted from "flow-coverage-report#flow-annotation-check#eslint#glob-parent" info Disk size without dependencies: "28KB" info Disk size with unique dependencies: "48KB" info Disk size with transitive dependencies: "64KB" info Number of shared dependencies: 2 => Found "chokidar#glob-parent@3.1.0" info This module exists because "@babel#cli#chokidar" depends on it. => Found "flow-copy-source#glob-parent@5.1.0" info Reasons this module exists - "flow-copy-source#chokidar" depends on it - Hoisted from "flow-copy-source#chokidar#glob-parent" β¨ Done in 0.60s. ```fixed
glob-parent
```zsh yarn why v1.22.5 [1/4] π€ Why do we have the module "glob-parent"...? [2/4] π Initialising dependency graph... [3/4] π Finding dependency... [4/4] π‘ Calculating file sizes... => Found "glob-parent@5.1.2" info Reasons this module exists - "eslint" depends on it - Hoisted from "eslint#glob-parent" - Hoisted from "flow-copy-source#chokidar#glob-parent" - Hoisted from "flow-coverage-report#flow-annotation-check#eslint#glob-parent" info Disk size without dependencies: "28KB" info Disk size with unique dependencies: "48KB" info Disk size with transitive dependencies: "64KB" info Number of shared dependencies: 1 β¨ Done in 0.75s. ```yargs-parser
```zsh yarn why v1.22.5 [1/4] π€ Why do we have the module "yargs-parser"...? [2/4] π Initialising dependency graph... [3/4] π Finding dependency... [4/4] π‘ Calculating file sizes... => Found "yargs-parser@18.1.3" info Reasons this module exists - "yargs" depends on it - Hoisted from "yargs#yargs-parser" info Disk size without dependencies: "92KB" info Disk size with unique dependencies: "128KB" info Disk size with transitive dependencies: "128KB" info Number of shared dependencies: 2 => Found "flow-coverage-report#yargs-parser@20.2.7" info Reasons this module exists - "flow-coverage-report#yargs" depends on it - Hoisted from "flow-coverage-report#yargs#yargs-parser" info Disk size without dependencies: "156KB" info Disk size with unique dependencies: "156KB" info Disk size with transitive dependencies: "156KB" info Number of shared dependencies: 0 β¨ Done in 0.66s. ```