chore(deps): update vulnerable dependencies

[kittaakos]

Motivation

To fix security issues.

Change description

• Forced the resolution of @babel/traverse@7.23.2 brought in by @theia/cli. (build(deps): bump @babel/traverse from 7.22.8 to 7.23.2 eclipse-theia/theia#13024)
• Updated to auth0-js@9.21.3 to transitively pull crypto-js@4.2.0 in with the security fixes.

Other information

TODOs:
@kittaakos will verify:

• the correctness of the @theia/cli (for @babel/traverse@7.23.2),
• the cloud sketches feature in IDE2 (for crypto-js@4.2.0),

@rhpco, please help with the security review. Thank you! If all works correctly, IDE2 will be down to zero security alerts.

Current behavior:

% yarn audit yarn audit v1.22.19 ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ critical │ Babel vulnerable to arbitrary code execution when compiling │ │ │ specifically crafted malicious code │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ @babel/traverse │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=7.23.2 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ @theia/cli │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ @theia/cli > @theia/application-manager > @babel/core > │ │ │ @babel/traverse │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1094446 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ critical │ Babel vulnerable to arbitrary code execution when compiling │ │ │ specifically crafted malicious code │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ @babel/traverse │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=7.23.2 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ @theia/cli │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ @theia/cli > @theia/application-manager > @babel/core > │ │ │ @babel/helpers > @babel/traverse │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1094446 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ critical │ crypto-js PBKDF2 1,000 times weaker than specified in 1993 │ │ │ and 1.3M times weaker than current standard │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ crypto-js │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=4.2.0 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ arduino-ide-extension │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ arduino-ide-extension > auth0-js > idtoken-verifier > │ │ │ crypto-js │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1094468 │ └───────────────┴──────────────────────────────────────────────────────────────┘ ┌───────────────┬──────────────────────────────────────────────────────────────┐ │ critical │ crypto-js PBKDF2 1,000 times weaker than specified in 1993 │ │ │ and 1.3M times weaker than current standard │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Package │ crypto-js │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Patched in │ >=4.2.0 │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Dependency of │ electron-app │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ Path │ electron-app > arduino-ide-extension > auth0-js > │ │ │ idtoken-verifier > crypto-js │ ├───────────────┼──────────────────────────────────────────────────────────────┤ │ More info │ https://www.npmjs.com/advisories/1094468 │ └───────────────┴──────────────────────────────────────────────────────────────┘ 4 vulnerabilities found - Packages audited: 2046 Severity: 4 Critical ✨ Done in 1.95s.

Expected behavior:

% yarn audit yarn audit v1.22.19 0 vulnerabilities found - Packages audited: 2046 ✨ Done in 2.26s.

GitHub Advisory Database refs:

• GHSA-67hx-6x53-jw92
• GHSA-xwcq-pm8m-c4vf

Upstream: eclipse-theia/theia#13024

Reviewer checklist

• PR addresses a single concern.
• The PR has no duplicates (please search among the Pull Requests before creating one)
• PR title and description are properly filled.
• Docs have been added / updated (for bug fixes / features)

[rhpco]

LGTM

[kittaakos]

@kittaakos will verify:

• the correctness of the @theia/cli (for @babel/traverse@7.23.2),
• the cloud sketches feature in IDE2 (for crypto-js@4.2.0),

It's working with 2.2.2-snapshot-f7c6da3.

[francescospissu]

LGTM 👍