[CVE-2020-8203] Bump cheerio to fix vulnerable lodash dependency

[manasvinibs]

Description

CVE fix

Issues Resolved

https://advisories.aws.barahmand.com/advisories/CVE-2020-8203

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (b2d2b26) 67.03% compared to head (6787dd5) 67.03%.
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5797      +/-   ##
==========================================
- Coverage   67.03%   67.03%   -0.01%     
==========================================
  Files        3296     3296              
  Lines       63343    63343              
  Branches    10087    10087              
==========================================
- Hits        42465    42463       -2     
- Misses      18429    18430       +1     
- Partials     2449     2450       +1     

Flag	Coverage Δ
Linux_1	35.23% <ø> (ø)
Linux_2	55.18% <ø> (ø)
Linux_3	43.91% <ø> (-0.02%)	⬇️
Linux_4	35.33% <ø> (ø)
Windows_1	35.26% <ø> (ø)
Windows_2	55.15% <ø> (ø)
Windows_3	43.93% <ø> (ø)
Windows_4	35.33% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[AMoo-Miki]

Additional info:

cheerio is used only by

• packages/osd-dev-utils/src/plugin_list/discover_plugins.ts to parse the first paragraph of the readme file
• test/functional/services/lib/web_element_wrapper/web_element_wrapper.ts to wrap elements for functional tests

With all tests passing, there is no concern about breaking changes, and none are declared on cheerio@1.0.0-rc1.

This bump was required to solve a CVE on lodash.pick which has no non-vulnerable version; last release was 8 years ago.
cheerio has newer versions, up to 1.0.0-rc12 but all of them declare breaking changes.

[opensearch-trigger-bot]

The backport to 2.x failed:

The process '/usr/bin/git' failed with exit code 128

To backport manually, run these commands in your terminal:

# Navigate to the root of your repository
cd $(git rev-parse --show-toplevel)
# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add ../.worktrees/OpenSearch-Dashboards/backport-2.x 2.x
# Navigate to the new working tree
pushd ../.worktrees/OpenSearch-Dashboards/backport-2.x
# Create a new branch
git switch --create backport/backport-5797-to-2.x
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick -x --mainline 1 aea8716aa711dc9f49ed649062b484f91a87da31
# Push it to GitHub
git push --set-upstream origin backport/backport-5797-to-2.x
# Go back to the original working tree
popd
# Delete the working tree
git worktree remove ../.worktrees/OpenSearch-Dashboards/backport-2.x

Then, create a pull request where the base branch is 2.x and the compare/head branch is backport/backport-5797-to-2.x.

[manasvinibs]

Manual backport 2.x #5806