Updating NPM dependencies

node_modules/node-forge/CHANGELOG.md

@@ -1,6 +1,46 @@
 Forge ChangeLog
 ===============
 
+## 0.10.0 - 2019-09-01
+
+### Changed
+- **BREAKING**: Node.js 4 no longer supported. The code *may* still work, and
+  non-invasive patches to keep it working will be considered. However, more
+  modern tools no longer support old Node.js versions making testing difficult.
+
+### Removed
+- **BREAKING**: Remove `util.getPath`, `util.setPath`, and `util.deletePath`.
+  `util.setPath` had a potential prototype pollution security issue when used
+  with unsafe inputs. These functions are not used by `forge` itself. They date
+  from an early time when `forge` was targeted at providing general helper
+  functions. The library direction changed to be more focused on cryptography.
+  Many other excellent libraries are more suitable for general utilities. If
+  you need a replacement for these functions, consier `get`, `set`, and `unset`
+  from [lodash](https://lodash.com/). But also consider the potential similar
+  security issues with those APIs.
+
+## 0.9.2 - 2019-09-01
+
+### Changed
+- Added `util.setPath` security note to function docs and to README.
+
+### Notes
+- **SECURITY**: The `util.setPath` function has the potential to cause
+  prototype pollution if used with unsafe input.
+  - This function is **not** used internally by `forge`.
+  - The rest of the library is unaffected by this issue.
+  - **Do not** use unsafe input with this function.
+  - Usage with known input should function as expected. (Including input
+    intentionally using potentially problematic keys.)
+  - No code changes will be made to address this issue in 0.9.x. The current
+    behavior *could* be considered a feature rather than a security issue.
+    0.10.0 will be released that removes `util.getPath` and `util.setPath`.
+    Consider `get` and `set` from [lodash](https://lodash.com/) if you need
+    replacements. But also consider the potential similar security issues with
+    those APIs.
+  - https://snyk.io/vuln/SNYK-JS-NODEFORGE-598677
+  - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7720
+
 ## 0.9.1 - 2019-09-26
 
 ### Fixed

node_modules/node-forge/dist/forge.all.min.js.map

@@ -1 +1 @@
-{"version":3,"file":"forge.all.min.js","sources":["webpack:///forge.all.min.js"],"mappings":"AAAA","sourceRoot":""}
+{"version":3,"file":"forge.all.min.js","sources":["webpack://[name]/forge.all.min.js"],"mappings":"AAAA","sourceRoot":""}

node_modules/node-forge/dist/forge.min.js.map

@@ -1 +1 @@
-{"version":3,"file":"forge.min.js","sources":["webpack:///forge.min.js"],"mappings":"AAAA","sourceRoot":""}
+{"version":3,"file":"forge.min.js","sources":["webpack://[name]/forge.min.js"],"mappings":"AAAA","sourceRoot":""}

node_modules/node-forge/lib/util.js

@@ -2513,99 +2513,6 @@ util.makeLink = function(path, query, fragment) {
     ((fragment.length > 0) ? ('#' + fragment) : '');
 };
 
-/**
- * Follows a path of keys deep into an object hierarchy and set a value.
- * If a key does not exist or it's value is not an object, create an
- * object in it's place. This can be destructive to a object tree if
- * leaf nodes are given as non-final path keys.
- * Used to avoid exceptions from missing parts of the path.
- *
- * @param object the starting object.
- * @param keys an array of string keys.
- * @param value the value to set.
- */
-util.setPath = function(object, keys, value) {
-  // need to start at an object
-  if(typeof(object) === 'object' && object !== null) {
-    var i = 0;
-    var len = keys.length;
-    while(i < len) {
-      var next = keys[i++];
-      if(i == len) {
-        // last
-        object[next] = value;
-      } else {
-        // more
-        var hasNext = (next in object);
-        if(!hasNext ||
-          (hasNext && typeof(object[next]) !== 'object') ||
-          (hasNext && object[next] === null)) {
-          object[next] = {};
-        }
-        object = object[next];
-      }
-    }
-  }
-};
-
-/**
- * Follows a path of keys deep into an object hierarchy and return a value.
- * If a key does not exist, create an object in it's place.
- * Used to avoid exceptions from missing parts of the path.
- *
- * @param object the starting object.
- * @param keys an array of string keys.
- * @param _default value to return if path not found.
- *
- * @return the value at the path if found, else default if given, else
- *         undefined.
- */
-util.getPath = function(object, keys, _default) {
-  var i = 0;
-  var len = keys.length;
-  var hasNext = true;
-  while(hasNext && i < len &&
-    typeof(object) === 'object' && object !== null) {
-    var next = keys[i++];
-    hasNext = next in object;
-    if(hasNext) {
-      object = object[next];
-    }
-  }
-  return (hasNext ? object : _default);
-};
-
-/**
- * Follow a path of keys deep into an object hierarchy and delete the
- * last one. If a key does not exist, do nothing.
- * Used to avoid exceptions from missing parts of the path.
- *
- * @param object the starting object.
- * @param keys an array of string keys.
- */
-util.deletePath = function(object, keys) {
-  // need to start at an object
-  if(typeof(object) === 'object' && object !== null) {
-    var i = 0;
-    var len = keys.length;
-    while(i < len) {
-      var next = keys[i++];
-      if(i == len) {
-        // last
-        delete object[next];
-      } else {
-        // more
-        if(!(next in object) ||
-          (typeof(object[next]) !== 'object') ||
-          (object[next] === null)) {
-           break;
-        }
-        object = object[next];
-      }
-    }
-  }
-};
-
 /**
  * Check if an object is empty.
  *

node_modules/node-forge/package.json

@@ -1,27 +1,27 @@
 {
-  "_from": "node-forge@^0.9.0",
-  "_id": "node-forge@0.9.1",
+  "_from": "node-forge@^0.10.0",
+  "_id": "node-forge@0.10.0",
   "_inBundle": false,
-  "_integrity": "sha512-G6RlQt5Sb4GMBzXvhfkeFmbqR6MzhtnT7VTHuLadjkii3rdYHNdw0m8zA4BTxVIh68FicCQ2NSUANpsqkr9jvQ==",
+  "_integrity": "sha512-PPmu8eEeG9saEUvI97fm4OYxXVB6bFvyNTyiUOBichBpFG8A1Ljw3bY62+5oOjDEMHRnd0Y7HQ+x7uzxOzC6JA==",
   "_location": "/node-forge",
   "_phantomChildren": {},
   "_requested": {
     "type": "range",
     "registry": true,
-    "raw": "node-forge@^0.9.0",
+    "raw": "node-forge@^0.10.0",
     "name": "node-forge",
     "escapedName": "node-forge",
-    "rawSpec": "^0.9.0",
+    "rawSpec": "^0.10.0",
     "saveSpec": null,
-    "fetchSpec": "^0.9.0"
+    "fetchSpec": "^0.10.0"
   },
   "_requiredBy": [
     "/google-p12-pem"
   ],
-  "_resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.9.1.tgz",
-  "_shasum": "775368e6846558ab6676858a4d8c6e8d16c677b5",
-  "_spec": "node-forge@^0.9.0",
-  "_where": "/Users/drew.heavner/Documents/Github/upload-google-play/node_modules/google-p12-pem",
+  "_resolved": "https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz",
+  "_shasum": "32dea2afb3e9926f02ee5ce8794902691a676bf3",
+  "_spec": "node-forge@^0.10.0",
+  "_where": "/home/codespace/workspace/upload-google-play/node_modules/google-p12-pem",
   "author": {
     "name": "Digital Bazaar, Inc.",
     "email": "support@digitalbazaar.com",
@@ -58,35 +58,36 @@
   "deprecated": false,
   "description": "JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.",
   "devDependencies": {
-    "browserify": "^16.1.0",
+    "browserify": "^16.5.2",
     "commander": "^2.20.0",
-    "cross-env": "^5.1.3",
-    "eslint": "^5.16.0",
-    "eslint-config-digitalbazaar": "^2.0.0",
+    "cross-env": "^5.2.1",
+    "eslint": "^7.8.1",
+    "eslint-config-digitalbazaar": "^2.5.0",
     "express": "^4.16.2",
-    "karma": "^3.1.4",
-    "karma-browserify": "^6.0.0",
-    "karma-chrome-launcher": "^2.2.0",
+    "karma": "^4.4.1",
+    "karma-browserify": "^7.0.0",
+    "karma-chrome-launcher": "^3.1.0",
     "karma-edge-launcher": "^0.4.2",
-    "karma-firefox-launcher": "^1.1.0",
+    "karma-firefox-launcher": "^1.3.0",
     "karma-ie-launcher": "^1.0.0",
     "karma-mocha": "^1.3.0",
     "karma-mocha-reporter": "^2.2.5",
     "karma-safari-launcher": "^1.0.0",
-    "karma-sauce-launcher": "^1.2.0",
-    "karma-sourcemap-loader": "^0.3.7",
+    "karma-sauce-launcher": "^2.0.2",
+    "karma-sourcemap-loader": "^0.3.8",
     "karma-tap-reporter": "0.0.6",
-    "karma-webpack": "^3.0.5",
+    "karma-webpack": "^4.0.2",
     "mocha": "^5.2.0",
     "mocha-lcov-reporter": "^1.2.0",
     "nodejs-websocket": "^1.7.1",
-    "nyc": "^14.1.1",
-    "opts": "^1.2.2",
-    "webpack": "^3.11.0",
+    "nyc": "^15.1.0",
+    "opts": "^1.2.7",
+    "webpack": "^4.44.1",
+    "webpack-cli": "^3.3.12",
     "worker-loader": "^2.0.0"
   },
   "engines": {
-    "node": ">= 4.5.0"
+    "node": ">= 6.0.0"
   },
   "files": [
     "lib/*.js",
@@ -153,5 +154,5 @@
     "test-server-webid": "node tests/websockets/server-webid.js",
     "test-server-ws": "node tests/websockets/server-ws.js"
   },
-  "version": "0.9.1"
+  "version": "0.10.0"
 }