Updates from npm update

[bickelj]

This update attempt was spurred by an alleged json5 vulnerability. It is a dev dependency and therefore should not be included in production code and therefore should not affect deployed instances of the software.

This commit includes an update to json5 v1 which should be compatible with eslint plugin and removes the vulnerability.

See import-js/eslint-plugin-import#2447 (comment)
See json5/json5#298

Issue #190 npm ci reports vulnerabilities...

[codecov]

Codecov Report

Base: 96.34% // Head: 96.34% // No change to project coverage 👍

Coverage data is based on head (aaccf51) compared to base (ea78d1c).
Patch has no changes to coverable lines.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #191   +/-   ##
=======================================
  Coverage   96.34%   96.34%           
=======================================
  Files          47       47           
  Lines         684      684           
  Branches      120      120           
=======================================
  Hits          659      659           
  Misses         24       24           
  Partials        1        1           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[bickelj]

Can the vulnerability be exploited somehow during build time here with the GH actions? Not sure. Regardless, it sounds like it should be fixed upstream soon enough.

[bickelj]

By the way, neither this nor npm audit fix --force fixed the npm audit output. So another npm update later will be needed (and pushed to this branch) or a dependabot update may push a separate PR and then this can be closed.

[bickelj]

aaccf51 has updates to both json5 v1 and v2. The v1 backport happened a few minutes ago. It still appears npm audit thinks there is a problem with the v1 version, perhaps this is just a CVE reporting issue, though (e.g. it says "all versions below v2.2.2 and needs to reflect the backport).