search-ui-react: Resolve Vulnerabilities

[mkouzel-yext]

Regenerates test-site/package-lock.json to include the safe dependencies.

J=VULN-39418, VULN-39419
TEST=none

Saw that babel imports in package-lock.json and test-site/package-lock.json were for versions at or above the safe dependency.

[coveralls]

coverage: 85.38%. remained the same
when pulling ae9dcbe on hotfix/v1.6.8
into 109b443 on main.

[Fondryext]

To make sure I understand, this PR is just regenerating test-site's package-lock to get the package updates? Your comments mention both package-locks but the base one doesn't look like it has any changes other than incrementing the version

[mkouzel-yext]

Yes, I just incremented the package version in ./package.json. If the only change to package-lock.json was its package version then that's fine - to be clear I basically just incremented the package version and ran rm -rf node_modules package-lock.json && npm i in . and ./test-site.

[Fondryext]

Since we're already doing this change, could you see if it would be easy to include https://yexttest.atlassian.net/browse/VULN-38477 as part of this? To reduce the number of patch versions. Thanks!

[mkouzel-yext]

I looked through test-site/package-lock.json and it now has a safe @babel/traverse version, so that other ticket should be fixed by this PR as well. I expect the issue was that the package-lock file hadn't been regenerated in test-site.

[vijay267]

I'm also a little confused by this change? Shouldn't there be some other changes upgrading the dependency causing a vulnerability like Jacob said? The test site is just a test site to be able to test search-ui-react so I'd expect the main repo's package.json to change more.

Also separately not sure why but seems like some of the github checks are failing.

[vijay267]

Maybe should be a separate change, but shouldn't this say [email protected]?

[Fondryext]

I figure we might as well do it here, since otherwise it'd be yet another patch version lol.

[vijay267]

True

[mkouzel-yext]

Added in new commit

[Fondryext]

I'm also a little confused by this change? Shouldn't there be some other changes upgrading the dependency causing a vulnerability like Jacob said? The test site is just a test site to be able to test search-ui-react so I'd expect the main repo's package.json to change more.

Also separately not sure why but seems like some of the github checks are failing.

To be clear @vijay267 , what happened was the normal package, the normal package-lock, and the test site package, all got updated in the previous version, but not the test site package lock. So that's what this change is.

[vijay267]

Ah got it. That makes sense then. Thanks for the explanation Jacob!

[github-actions]

Current unit coverage is 92.12481426448737%
Current visual coverage is 79.01234567901234%
Current combined coverage is 92.62376237623762%