Upgrade ansi-regex dependency to address CVE-2021-3807

[pzi]

Description

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3807
https://security.snyk.io/vuln/SNYK-JS-ANSIREGEX-1583908

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) due to the sub-patterns [\#;?]* and (?:;[-a-zA-Z\d\/#&.:=?%@~_]).

• Introduced through: @sitecore-jss/[email protected] › @sitecore-jss/[email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Introduced through: @sitecore-jss/[email protected] › @sitecore-jss/[email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Introduced through: @sitecore-jss/[email protected] › @sitecore-jss/[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Introduced through: @sitecore-jss/[email protected] › @sitecore-jss/[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]
• Introduced through: @sitecore-jss/[email protected] › @sitecore-jss/[email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected] › [email protected]

Expected behavior

No security issues.

Steps To Reproduce

1. npm install
2. npm audit
3. See warnings

Possible Fix

npm upgrade ansi-regex

Upgrade ansi-regex to version 6.0.1, 5.0.1 or higher.

Your Environment

• JSS Version: 19.0.2

[ambrauer]

@pzi Thanks for the heads up. We perform a security audit and address vulnerabilities typically once-per-release cycle. We'll make sure this one is addressed. In this case, it appears to be low risk since the affected module would only be used for development purposes.

[pzi]

Ok, thanks for responding promptly and offering to fix it in the next release cycle.

[art-alexeyenko]

@pzi Starting from JSS 20 sitecore-jss-manifest is merged into sitecore-dev-tools, and these deps you mentioned are addressed. Some extra deps were addressed in dev too.
Small note - there's one instance of the older ansi-regex version left in out-of-the-box JSS nextjs sample, through @graphql-codegen/cli.
It's a dev dependency and the way it is set up I don't any ways to exploit it.