[CVE-2021-35065][1.x] Bump glob-parent from 6.0.0 to 6.0.2

[ananzh]

Issue Resolve

#1103

Description

glob-parent before 6.0.1 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1. glob-parent is used in multiple places and they are currently resolved to version 6.0.0.

ubuntu@ip-172-31-55-237:~/work/OpenSearch-Dashboards$ yarn why glob-parent
yarn why v1.22.19
[1/4] Why do we have the module "glob-parent"...?
[2/4] Initialising dependency graph...
warning Resolution field "typescript@4.0.2" is incompatible with requested version "typescript@~3.7.2"
warning Resolution field "shelljs@0.8.5" is incompatible with requested version "shelljs@^0.6.0"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "glob-parent@6.0.0"
info Reasons this module exists
   - "_project_#fast-glob" depends on it
   - Hoisted from "_project_#fast-glob#glob-parent"
   - Hoisted from "_project_#eslint#glob-parent"
   - Hoisted from "_project_#chokidar#glob-parent"
   - Hoisted from "_project_#vinyl-fs#glob-stream#glob-parent"
   - Hoisted from "_project_#@osd#interpreter#copy-webpack-plugin#glob-parent"
   - Hoisted from "_project_#mocha#chokidar#glob-parent"
   - Hoisted from "_project_#@osd#ui-framework#webpack-dev-server#chokidar#glob-parent"
   - Hoisted from "_project_#@percy#agent#globby#fast-glob#glob-parent"
   - Hoisted from "_project_#del#globby#fast-glob#glob-parent"
   - Hoisted from "_project_#@osd#interpreter#copy-webpack-plugin#fast-glob#glob-parent"
   - Hoisted from "_project_#@osd#optimizer#@babel#cli#@nicolo-ribaudo#chokidar-2#glob-parent"
   - Hoisted from "_project_#@osd#optimizer#@babel#cli#chokidar#glob-parent"
   - Hoisted from "_project_#@osd#config#tsd#globby#fast-glob#glob-parent"
   - Hoisted from "_project_#backport#del#globby#fast-glob#glob-parent"
   - Hoisted from "_project_#@elastic#safer-lodash-set#dependency-check#globby#fast-glob#glob-parent"
   - Hoisted from "_project_#@osd#ui-shared-deps#webpack#watchpack#watchpack-chokidar2#chokidar#glob-parent"
   - Hoisted from "_project_#@osd#utility-types#del-cli#del#globby#fast-glob#glob-parent"
   - Hoisted from "_project_#eslint-plugin-jest#@typescript-eslint#experimental-utils#@typescript-eslint#typescript-estree#globby#fast-glob#glob-parent"
info Disk size without dependencies: "28KB"
info Disk size with unique dependencies: "48KB"
info Disk size with transitive dependencies: "64KB"
info Number of shared dependencies: 2
=> Found "@types/globby#glob-parent@6.0.0"
info Reasons this module exists
   - "_project_#@types#globby#fast-glob" depends on it
   - Hoisted from "_project_#@types#globby#fast-glob#glob-parent"
   - in the nohoist list ["/_project_/**/@types/*","/_project_/**/@types/*/**","/_project_/**/grunt-*","/_project_/**/grunt-*/**","/_project_/@elastic/eui/rehype-react","/_project_/@elastic/eui/remark-rehype","/_project_/@elastic/eui/remark-rehype/**"]
info Disk size without dependencies: "28KB"
info Disk size with unique dependencies: "48KB"
info Disk size with transitive dependencies: "64KB"
info Number of shared dependencies: 2
=> Found "@osd/optimizer#glob-parent@6.0.0"
info Reasons this module exists
   - "_project_#@osd#optimizer#@types#watchpack#chokidar" depends on it
   - Hoisted from "_project_#@osd#optimizer#@types#watchpack#chokidar#glob-parent"
   - in the nohoist list ["/_project_/**/@types/*","/_project_/**/@types/*/**","/_project_/**/grunt-*","/_project_/**/grunt-*/**","/_project_/@elastic/eui/rehype-react","/_project_/@elastic/eui/remark-rehype","/_project_/@elastic/eui/remark-rehype/**"]
info Disk size without dependencies: "28KB"
info Disk size with unique dependencies: "48KB"
info Disk size with transitive dependencies: "64KB"
info Number of shared dependencies: 2
=> Found "@osd/pm#glob-parent@6.0.0"
info Reasons this module exists
   - "_project_#@osd#pm#@types#globby#fast-glob" depends on it
   - Hoisted from "_project_#@osd#pm#@types#globby#fast-glob#glob-parent"
   - in the nohoist list ["/_project_/**/@types/*","/_project_/**/@types/*/**","/_project_/**/grunt-*","/_project_/**/grunt-*/**","/_project_/@elastic/eui/rehype-react","/_project_/@elastic/eui/remark-rehype","/_project_/@elastic/eui/remark-rehype/**"]
info Disk size without dependencies: "28KB"
info Disk size with unique dependencies: "48KB"
info Disk size with transitive dependencies: "64KB"
info Number of shared dependencies: 2
Done in 1.07s.

Since there is no breaking changes between 6.0.2 (latest) and current 6.0.0, we could update the resolution to 6.0.2.

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
  • yarn test:ftr
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[codecov-commenter]

Codecov Report

Merging #3742 (e5246df) into 1.x (637d545) will increase coverage by 0.04%.
The diff coverage is n/a.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@            Coverage Diff             @@
##              1.x    #3742      +/-   ##
==========================================
+ Coverage   67.45%   67.49%   +0.04%     
==========================================
  Files        3044     3044              
  Lines       58692    58692              
  Branches     8902     8902              
==========================================
+ Hits        39593    39617      +24     
+ Misses      16946    16926      -20     
+ Partials     2153     2149       -4     

Flag	Coverage Δ
Linux	67.45% <ø> (-0.01%)	⬇️
Windows	67.45% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 8 files with indirect coverage changes

[joshuarrrr]

Thanks!