chore(deps): update vulnerable dependencies

[kittaakos]

Motivation

To fix security issues.

Change description

• Forced the resolution of @babel/[email protected] brought in by @theia/cli. (build(deps): bump @babel/traverse from 7.22.8 to 7.23.2 eclipse-theia/theia#13024)
• Updated to [email protected] to transitively pull [email protected] in with the security fixes.

Other information

TODOs:
@kittaakos will verify:

• the correctness of the @theia/cli (for @babel/[email protected]),
• the cloud sketches feature in IDE2 (for [email protected]),

@rhpco, please help with the security review. Thank you! If all works correctly, IDE2 will be down to zero security alerts.

Current behavior:

% yarn audit
yarn audit v1.22.19
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ Babel vulnerable to arbitrary code execution when compiling  │
│               │ specifically crafted malicious code                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ @babel/traverse                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=7.23.2                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @theia/cli                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @theia/cli > @theia/application-manager > @babel/core >      │
│               │ @babel/traverse                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1094446                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ Babel vulnerable to arbitrary code execution when compiling  │
│               │ specifically crafted malicious code                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ @babel/traverse                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=7.23.2                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @theia/cli                                                   │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @theia/cli > @theia/application-manager > @babel/core >      │
│               │ @babel/helpers > @babel/traverse                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1094446                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ crypto-js PBKDF2 1,000 times weaker than specified in 1993   │
│               │ and 1.3M times weaker than current standard                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ crypto-js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.2.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ arduino-ide-extension                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ arduino-ide-extension > auth0-js > idtoken-verifier >        │
│               │ crypto-js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1094468                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ critical      │ crypto-js PBKDF2 1,000 times weaker than specified in 1993   │
│               │ and 1.3M times weaker than current standard                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ crypto-js                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.2.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron-app                                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ electron-app > arduino-ide-extension > auth0-js >            │
│               │ idtoken-verifier > crypto-js                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://www.npmjs.com/advisories/1094468                     │
└───────────────┴──────────────────────────────────────────────────────────────┘
4 vulnerabilities found - Packages audited: 2046
Severity: 4 Critical
✨  Done in 1.95s.

Expected behavior:

% yarn audit
yarn audit v1.22.19
0 vulnerabilities found - Packages audited: 2046
✨  Done in 2.26s.

GitHub Advisory Database refs:

• GHSA-67hx-6x53-jw92
• GHSA-xwcq-pm8m-c4vf

Upstream: eclipse-theia/theia#13024

Reviewer checklist

• PR addresses a single concern.
• The PR has no duplicates (please search among the Pull Requests before creating one)
• PR title and description are properly filled.
• Docs have been added / updated (for bug fixes / features)

[rhpco]

LGTM

[kittaakos]

@kittaakos will verify:

• the correctness of the @theia/cli (for @babel/[email protected]),
• the cloud sketches feature in IDE2 (for [email protected]),

It's working with 2.2.2-snapshot-f7c6da3.

[francescospissu]

LGTM 👍