Fix high sev security issue

[wanlwanl]

https://github.com/Azure/azure-sdk-tools/security/dependabot/137
https://github.com/Azure/azure-sdk-tools/security/dependabot/175

[raych1]

@wanlwanl , I don't see the lodash related upgrade. Was it removed?

Can you add yourself to the owner of js-sdk-release-tools path in ./github/CODEOWNERS file?

[wanlwanl]

@wanlwanl , I don't see the lodash related upgrade. Was it removed?

Can you add yourself to the owner of js-sdk-release-tools path in ./github/CODEOWNERS file?

@raych1
Yes, upgrade the package use lodash originally, the package doesn't depend on lodash anymore

[raych1]

@wanlwanl , you need to join public Azure org to resolve the codeowner CI failures.

[wanlwanl]

@wanlwanl , you need to join public Azure org to resolve the codeowner CI failures.
@raych1
I am already member of public azure org, check it out:https://github.com/orgs/Azure/people?query=wanpeng

[qiaozha]

LGTM

[qiaozha]

/check-enforcer override

[weshaggard]

Let's avoid overriding check-enforcer. The ci job should have ran but was disabled because of lack of running. I've re-enabled it so it should trigger on future changes.

[weshaggard]

Why are we using a submodule? Submodules cause all sorts of issues and we generally avoid them. If you need this dependency then we should publish the package instead of using a submodule.

[weshaggard]

One example of such an issue https://github.com/Azure/azure-sdk-tools/security/dependabot/178/update-logs/370202889

[wanlwanl]

Thanks @weshaggard for checking it and kindly share the guidance.

Previous tool owner used a package https://www.npmjs.com/package/@ts-common/azure-js-dev-tools
but looks like no one maintain it any more, latest version still has the same security issue. So I add submodule to update the braces package. We will definitely avoid to use packages out of maintainence in the future.

No worries, I'll downgrade the package to resolve security issue.