Upgrade vulnerable dependencies

[medikoo]

We need to upgrade following dependencies.

• boxen (see update boxen and update-notifier #7226) (Addressed with build(dependency): upgrade to boxen@v4.2.0 #8163)
• update-notifier (see update boxen and update-notifier #7226 and npm audit vulnerability from dot-prop #8008) (Addressed with Upgrade update-notifier to v4 #8182)
• mkdirp (see Serverless Framework has a transitive HIGH NVD Vulnerability #7455) - Replace with fs-extra's ensureDir (Addressed with Drop mkdrip dependency #8183)

Ideally each upgrade should be addressed with different PR.

PR's should be based against v2 branch

[exoego]

We may remove mkdirp dependency, since Node.js 10.12.0 added recursive option to fs.mkdir.

https://nodejs.org/api/fs.html#fs_fs_mkdir_path_options_callback

[exoego]

How about removing update-notifier on serverless v2?
IMHO, update notification is less valuable nowadays,
because there are many ways to update dependencies automatically, e.g. dependabot, greenkeeper and so on.

One example of npm module that removed update-notifier.
palantir/tslint#2262

[medikoo]

@exoego thanks for suggestion. Still it doesn't apply that much in serverless case as it's top level package (not typical dependency)

Many developers use just global (or standalone) installation and naturally in such case they're not tracking new updates via some external means

[exoego]

Ah, thats true.
I forgot about global installation.

[instantlinux]

I have an enterprise installation of this for which dot-prop and update-notifier really need to be cleared of high-severity vulnerabilities like advisory #1213.

[Trott]

I can think of a few ways around this for update-notifier (which has dot-prop as a vulnerable dependency), but I'm not sure if they'll be acceptable to the serverless maintainers or not.

Easiest option might be to bump update-notifier to the current version but don't load it if the user is running Node.js 6. On the one hand, I guess it's a little rude to not tell Node.js 6 users when they can/should update serverless. On the other hand, perhaps this is snobbish or something, but Node.js 6 went EOL almost a year-and-a-half ago as of this writing, so maybe they're not very likely to upgrade stuff anyway for whatever reason. (Yes, I'm making assumptions that if they can't/don't update Node.js, they can't/don't update serverless, and that assumption may be wrong.)

There are other options, but I'd start with that one. I'll open a PR for that and see what happens with it.

[Trott]

There are other options, but I'd start with that one. I'll open a PR for that and see what happens with it.

Well, the PR template has this:

⚠️⚠️ Do not propose PR's without prior agreement on solution in corresponding issue

So maybe I'll wait for a maintainer to comment.....

[Trott]

Here's the change I'm suggesting: https://github.com/serverless/serverless/compare/master...Trott:update-notifier?expand=1

[medikoo]

@Trott thanks for proposal.

I think the right approach is simply to drop support for Node.js v6 & v8 and release a new major, I will discuss it internally, and hopefully by end of this month we will have that sorted out.

[Trott]

Good news: dot-prop@4.2.1 has been published with the security fix. sindresorhus/dot-prop#63 (comment)

[Trott]

Good news: dot-prop@4.2.1 has been published with the security fix. sindresorhus/dot-prop#63 (comment)

Whether the automated tools that report the issue pick that fact up or not remains to be seen....

[instantlinux]

Before jumping on dot-prop@4.2.1 hastily, please double-check the integrity of the upstream. I see that the source repo on github has not been updated (see the commit history of https://github.com/sindresorhus/dot-prop where the latest 4.x tag is 4.2.0) yet there's a new version 4.2.1 posted at npmjs. I don't know how to account for this discrepancy but for a high-popularity repo like that with ~15M downloads weekly I'd like to know why it exists. (There is an apparent/incomplete transition in maintenance of that upstream repo, see discussion in their issue sindresorhus/dot-prop#63. What's published to npmjs came from a fork rather than a merged PR.)

[Trott]

I see that the source repo on github has not been updated (see the commit history of https://github.com/sindresorhus/dot-prop where the latest 4.x tag is 4.2.0) yet there's a new version 4.2.1 posted at npmjs.

Fixed. sindresorhus/dot-prop#63 (comment)

[medikoo]

I'm glad to announce that we will release v2 next week. PR that upgrades vulnerable dependencies is welcome (I've updated main description)!