chore: address js dependency security issues

[darrenjaneczek]

• More progress toward Sort out NPM dependencies #2000, post /og merge.

trivy filesystem ./yarn.lock

In next, it yields:

Total: 17 (UNKNOWN: 0, LOW: 2, MEDIUM: 7, HIGH: 7, CRITICAL: 1)

See comments below for updated trivy reports.

[darrenjaneczek]

The loader-utils was causing issues, so I reverted it for now.

Here is the current report:

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 1)

┌──────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                            Title                            │
├──────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ @cypress/request │ CVE-2023-28155 │ MEDIUM   │ 2.88.11           │ 3.0.0         │ The Request package through 2.88.1 for Node.js allows a     │
│                  │                │          │                   │               │ bypass of SSRF...                                           │
│                  │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2023-28155                  │
├──────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────────┤
│ loader-utils     │ CVE-2022-37601 │ CRITICAL │ 0.2.17            │ 1.4.1, 2.0.3  │ prototype pollution in function parseQuery in parseQuery.js │
│                  │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2022-37601                  │
└──────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────────┘

[darrenjaneczek]

Found a better compromise:

Total: 1 (UNKNOWN: 0, LOW: 0, MEDIUM: 1, HIGH: 0, CRITICAL: 0)

┌──────────────────┬────────────────┬──────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────┐
│     Library      │ Vulnerability  │ Severity │ Installed Version │ Fixed Version │                          Title                          │
├──────────────────┼────────────────┼──────────┼───────────────────┼───────────────┼─────────────────────────────────────────────────────────┤
│ @cypress/request │ CVE-2023-28155 │ MEDIUM   │ 2.88.11           │ 3.0.0         │ The Request package through 2.88.1 for Node.js allows a │
│                  │                │          │                   │               │ bypass of SSRF...                                       │
│                  │                │          │                   │               │ https://avd.aquasec.com/nvd/cve-2023-28155              │
└──────────────────┴────────────────┴──────────┴───────────────────┴───────────────┴─────────────────────────────────────────────────────────┘

Given the cypress is not an actual runtime dependency (dev dependency for testing only), I am not worried about this warning. We can address this later once we bring cypress testing back online.

[Rperry2174]

LGTM!