Bump JSON5 dependency to 2.2.2 to fix CVE-2022-46175

[oparisblue]

Versions of JSON5 < 2.2.2 are susceptible to CVE-2022-46175.

This PR bumps this project's dependency to 2.2.2, which resolves this vulnerability. There are no other changes / no breaking changes in the version bump (changelog)

[genisd]

Might need to bump the version 4.1.1 in the package.json also to for example 4.1.2
A backport with a 3.x release would be really nice as well.

Version 4.1.1 loads json5 with ^2.2.1 so it can already be updated, not so much the case in the latest 3.x release

[ShaharLahav]

Please approve this :( @jonaskello

[codecov]

Codecov Report

Base: 68.16% // Head: 68.16% // No change to project coverage 👍

Coverage data is based on head (c091ec3) compared to base (1b71683).
Patch has no changes to coverable lines.

Additional details and impacted files

@@           Coverage Diff           @@
##           master     #232   +/-   ##
=======================================
  Coverage   68.16%   68.16%           
=======================================
  Files           9        9           
  Lines         311      311           
  Branches       96       96           
=======================================
  Hits          212      212           
  Misses         93       93           
  Partials        6        6           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[oparisblue]

Thanks for the review @genisd, bumped version to 4.1.2: 1603bab

[jonaskello]

Actually the version of tsconfig-paths in package.json is set automatically by the release script so it should not be incremented in the PR. @oparisblue could you please revert that commit?

[oparisblue]

Reverted back to v4.1.1 @jonaskello : c091ec3

[jordanbtucker]

I've backported a fix for json5 v1 in v1.0.2. We just have to wait for GitHub to update the advisory to reflect that, which is already in process. So tsconfig-paths@3 can be backported without any breaking changes.

[jonaskello]

Released in 4.1.2

[jordanbtucker]

The security advisory is finally updated and [email protected] is recognized as patching CVE-2022-46175.

[mihaiplesa]

v3 fix at #234