Overview

What is the feature?

Fixes the following vulnerabilities identified in EDSC:

Improper Verification of Cryptographic Signature
Uncontrolled resource consumption
Resource Exhaustion
Regular Expression Denial of Service (ReDoS)

What is the Solution?

Upgraded the package versions for elliptic, braces, and browserify-sign. All of these are required by other packages that have not updated their dependencies to reference updated versions yet.

Then, I manually upgraded several AWS packages identified by npm audit so that we could identify which were resulting in the largest changes in package-lock.json. Finally, ran npm audit fix for the remaining packages.

What areas of the application does this impact?

Cryptography, brace expansion, AWS API clients via XML parsing library.

Testing

Environment for testing: SIT

Do regression testing following the EDSC regression test guide.

Checklist

[ ] I have added automated tests that prove my fix is effective or that my feature works
[x] New and existing unit tests pass locally with my changes
[x] I have performed a self-review of my own code
[ ] I have commented my code, particularly in hard-to-understand areas
[ ] I have made corresponding changes to the documentation
[x] My changes generate no new warnings

nasa / earthdata-search

EDSC-4228: upgrade packages with npm audit fix #1795