fix: Remove CVE-2022-23539 vulnerability by updating the jsonwebtoken packages

overrides/lodash.pick/package.json

@@ -0,0 +1,8 @@
+{
+    "name": "lodash.pick",
+    "version": "0.0.1",
+    "main": "pick.js",
+    "peerDependencies": {
+        "lodash": "^4.17.21"
+    }
+}

overrides/lodash.pick/pick.js

@@ -0,0 +1,6 @@
+/**
+ * Copyright (c) Microsoft Corporation. All rights reserved.
+ * Licensed under the MIT License.
+ */
+const { pick } = require('lodash');
+module.exports = pick;

package.json

@@ -48,8 +48,6 @@
     "node-fetch": "2.6.7",
     "underscore": "1.13.1",
     "json-schema": "0.4.0",
-    "jsonwebtoken": "9.0.2",
-    "@types/jsonwebtoken": "8.3.5",
     "@microsoft/recognizers-text-number": "~1.3.1",
     "@xmldom/xmldom": "0.8.6",
     "**/botbuilder-azure/@azure/core-auth/@azure/core-tracing": "1.0.0-preview.9",
@@ -66,10 +64,10 @@
     "tar": "6.1.9",
     "glob-parent": "5.1.2",
     "babel-traverse": "npm:@babel/traverse@^7.24.7",
-    "lodash.pick": "npm:lodash@^4.17.21"
+    "lodash.pick": "file:overrides/lodash.pick"
   },
   "resolutionComments": {
-    "lodash.pick": "Because we can't update nightwatch due to jsdom requires node >= 18. https://github.com/lodash/lodash/issues/5809#issuecomment-1910560681"
+    "lodash.pick": "Remove the resolution and override project when supporting Node >=18. Because we can't update nightwatch due to jsdom requires node >= 18. https://github.com/lodash/lodash/issues/5809#issuecomment-1910560681"
   },
   "devDependencies": {
     "@azure/logger": "^1.0.2",

testing/browser-functional/.gitignore

@@ -1,2 +1,4 @@
 *.xml
-*.log
+*.log
+drivers
+tests_output

testing/browser-functional/browser-echo-bot/package.json

@@ -15,7 +15,7 @@
     "botbuilder-core": "^4.5.1",
     "botbuilder-dialogs": "~4.5.1",
     "botframework-directlinejs": "~0.11.2",
-    "botframework-webchat": "4.5.0",
+    "botframework-webchat": "~4.16.0",
     "core-js": "^3.1.4"
   },
   "devDependencies": {
@@ -26,9 +26,12 @@
     "@babel/preset-typescript": "^7.23.2",
     "@babel/runtime": "^7.23.2",
     "babel-loader": "^8.0.6",
+    "browserify": "^17.0.0",
     "clean-webpack-plugin": "^4.0.0",
     "copy-webpack-plugin": "^11.0.0",
     "css-loader": "^3.0.0",
+    "react": "~16.8.6",
+    "react-dom": "~16.8.6",
     "regenerator-runtime": "^0.13.2",
     "stream-browserify": "^3.0.0",
     "style-loader": "^0.23.1",
@@ -37,9 +40,11 @@
     "webpack-dev-server": "^4.15.2"
   },
   "resolutions": {
-    "follow-redirects": "^1.15.4"
+    "follow-redirects": "^1.15.4",
+    "botframework-webchat/sanitize-html": "^2.13.0"
   },
   "overrides": {
-    "follow-redirects": "^1.15.4"
+    "follow-redirects": "^1.15.4",
+    "botframework-webchat/sanitize-html": "^2.13.0"
   }
 }

testing/browser-functional/browser-echo-bot/webpack.config.js

@@ -3,17 +3,23 @@
  * Licensed under the MIT License.
  */
 
-const { join, resolve } = require('path');
+const { join, resolve, dirname } = require('path');
 const { CleanWebpackPlugin } = require('clean-webpack-plugin');
 const CopyWebpackPlugin = require('copy-webpack-plugin');
 const webpack = require('webpack');
 
+// Returns absolute path to package.json file for a package
+const resolvePackageJson = (name) => require.resolve(`${name}/package.json`);
+
+// Returns absolute path to directory containing package.json file for a package
+const resolvePackageRoot = (name) => dirname(resolvePackageJson(name));
+
 module.exports = {
     entry: './src/app.ts',
     devtool: 'source-map',
     devServer: {
         static: './dist',
-        hot: true
+        hot: true,
     },
     mode: 'development',
     module: {
@@ -22,22 +28,21 @@ module.exports = {
                 test: /\.[jt]s$/,
                 include: [
                     join(__dirname, 'src'),
-                    join(__dirname, 'node_modules/botbuilder-core/lib'),
+                    resolvePackageRoot('botbuilder-core'),
+                    resolvePackageRoot('botbuilder-dialogs'),
                 ],
-                use: ['babel-loader']
+                use: ['babel-loader'],
             },
             {
                 test: /\.css$/,
-                use: ['style-loader', 'css-loader']
-            }
-        ]
+                use: ['style-loader', 'css-loader'],
+            },
+        ],
     },
     plugins: [
         new CleanWebpackPlugin(),
         new CopyWebpackPlugin({
-            patterns: [
-                { from: resolve(__dirname, 'index.html'), to: '' }
-            ]
+            patterns: [{ from: resolve(__dirname, 'index.html'), to: '' }],
         }),
         // Work around for Buffer is undefined:
         // https://github.com/webpack/changelog-v5/issues/10
@@ -57,12 +62,12 @@ module.exports = {
             vm: false,
             path: false,
             crypto: false,
-            stream: require.resolve("stream-browserify"),
-            buffer: require.resolve("buffer")
-        }
+            stream: require.resolve('stream-browserify'),
+            buffer: require.resolve('buffer')
+        },
     },
     output: {
         filename: 'app.js',
-        path: resolve(__dirname, 'dist')
-    }
+        path: resolve(__dirname, 'dist'),
+    },
 };