Update grpc version when upstream security issue is fixed

[lukehoban]

When installing 0.12.1 NPM packages on Node 8.10 on Linux, I see this:

Installing dependencies...
npm WARN notice [SECURITY] protobufjs has 1 moderate vulnerability. Go here for more details: https://nodesecurity.io/advisories?search=protobufjs&version=5.0.2 - Run `npm i npm@latest -g` to upgrade your npm version, and then `npm audit` to get more info.

> grpc@1.11.3 install /home/ec2-user/test/node_modules/grpc
> node-pre-gyp install --fallback-to-build --library=static_library

[grpc] Success: "/home/ec2-user/test/node_modules/grpc/src/node/extension_binary/node-v57-linux-x64-glibc/grpc_node.node" is installed via remote

> @pulumi/aws@0.12.1 install /home/ec2-user/test/node_modules/@pulumi/aws
> pulumi plugin install resource aws v0.12.1

[swgillespie]

This comes from our gRPC dependency, I'll see if I can bump the version as part of #1320.

[ericrudder]

one thing we might want to consider as part of this fix is whether can can run npm audit (new in 5.10.x or something something) and make sure we are clean before we ever publish ​

[joeduffy]

I love the idea of running the new audit command in CI.

Would doing so have caught this specific issue?

[joeduffy]

TL;DR, I looked into this after seeing the error pop up in @mehzer's otherwise immaculate video. Sadly, the latest grpc package, 1.11.3, which we depend on directly, has a dependency on ^5.0.0 of protobufjs. So, nothing we do can force it to accept 6.8.6, which has the patch.

I coded up the rejection of make ensures that contain npm audit failures, so I know we can trivially do this if we want. The problem that the above situation points out is that there will be cases outside of our control that inevitably mean we're stuck with failures that we can't do anything with.

I wish there was a way to only audit immediate dependencies, but that does not appear to be the case.

@ellismg and @justinvp in the meantime, should we suppress this for our installer/templates, using npm install ... --no-audit, to avoid scaring people away with the frightening red bangs?

[ellismg]

It looks like grpc/grpc-node#277 tracks taking the fix into upstream.

[ellismg]

I've checked in the mitigation such that pulumi new no longer causes an audit to be done. I've moved this issue to M15, and changed the title to reflect that we need to update when upstream makes a release.

We'll probably also want to remove the --no-audit flag at the same time.