fix(security): address CVE-2021-23337

[aldousalvarez]

Fixes #1778 Depends on #1775

[petermetz]

@aldousalvarez Please resolve the conflicts and then the CI should run and we'll see if the changes work or not. I am a bit suspicious there though because you only updated the dependencies but not the imports in the code nor the usage of the methods (which may be fine if it's a drop-in replacement for all the methods that we use but I don't know that for sure either from the top of my head)

[petermetz]

@aldousalvarez @zondervancalvez If this depends on #1816 (or the other way around) then please make sure to declare that dependency in the PR description so that the robot enforces the merge order correctly.

[petermetz]

@aldousalvarez Please make sure to rebase onto the parent PR once the conflicts are fixed there. Then also make sure that the tests here are also passing.

[petermetz]

@aldousalvarez Please add a commit to this branch that updates the resolutions in the root package.json to specify >=4.17.21 as the lodash version

E.g., instead of this:

  "resolutions": {
    "ansi-html": ">0.0.8",
    "glob-parent": "5.1.2",
    "lodash": "4.17.20",
    "minimist": ">=1.2.6",
    "node-forge": ">=1.3.0",
    "underscore": "1.13.2"
  }

We need this:

  "resolutions": {
    "ansi-html": ">0.0.8",
    "glob-parent": "5.1.2",
    "lodash": ">=4.17.21",
    "minimist": ">=1.2.6",
    "node-forge": ">=1.3.0",
    "underscore": "1.13.2"
  }

Once you add that commit to this branch, the PR can be reopened and merged.

[petermetz]

^^ See my above request

[aldousalvarez]

Hello @petermetz I have committed the changes that you requested on to this branch aldousalvarez/issue1778. Will the PR be opened again? Thank you.

[github-actions]

This PR/issue depends on:

• fix(security): address CVE-2021-23358 #1775
  By Dependent Issues (🤖). Happy coding!

[petermetz]

@aldousalvarez Yes, I reopened it just now. LGTM