update lodash@^4.17.21:, dns-packet@^1.34: through dependencies resol…

[Ibrahimmaga]

Pull Request

📖 Description

CVE-2021-23386
high severity
Vulnerable versions: < 5.2.2
Patched version: 5.2.2
This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

CVE-2021-23337
high severity
Vulnerable versions: < 4.17.21
Patched version: 4.17.21
lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

🎫 Issues

👩‍💻 Reviewer Notes

📑 Test Plan

✅ Checklist

General

• I have included a change request file using $ yarn change
• I have added tests for my changes.
• I have tested my changes.
• I have updated the project documentation to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the standards for this project.

Component-specific

• I have added a new component
• I have modified an existing component
• I have updated the definition file
• I have updated the configuration file

⏭ Next Steps

[EisenbergEffect]

Added @radium-v as a reviewer. I defer my "required" review to him.

[awentzel]

@Ibrahimmaga what is your testing process and how did you go about testing?

[Ibrahimmaga]

The testing is done locally by running yarn after the update. The dependencies are also validated when running the pipeline on clean servers. An update through resolution means we will have both old versions and the new version on yarn.lock so things don't break because of the new update.

[awentzel]

The testing is done locally by running yarn after the update. The dependencies are also validated when running the pipeline on clean servers. An update through resolution means we will have both old versions and the new version on yarn.lock so things don't break because of the new update.

I would also get in the habit of running each script in the package.json file that's being updated to ensure there are no unforeseen breakages.

[radium-v]

@Ibrahimmaga can you regenerate the lockfile and update the PR title now that dns-packet is resolving to ^1.3.4?