Update vulnerable dependencies

[ScottRudiger]

This patches 7 vulnerabilities in the package's dependencies; most notably:

• handlebars (dep of jsdoc-to-markdown)
• mime (dep of @auth0/component-cdn-uploader)

The others were low severity such as Prototype Pollution.

To catch these more easily going forward, I'd recommend the following:

• 📦 Switch to npm, which catches these vulnerabilities on install and make use of its excellent npm audit feature.

• 🤖 Consider automating dependency updates (Renovate or Greenkeeper). I prefer Renovate as I'm just more familiar with it.

I'd be happy to help with either of these if desired. 👍

[luisrudge]

Thanks! We've been thinking about automating our dependency management, but never got around to actually do it. What's your experience with both services?

[ScottRudiger]

I haven't actually used Greenkeeper, but read up on it before choosing Renovate. Greenkeeper seems like a fine service if you plan to review each and every pull request for a dependency update (major/minor/patch). However, Renovate is highly configurable.

For instance, you could set it to open PRs on a schedule to reduce "noise;" e.g., every weekend or after 6pm on friday (I noticed Auth0 employees tend to not work on weekends, which is great! 👍).

There's an automerge feature as well, which you could set to go ahead and merge patch and minor updates as long as tests pass, while allowing a manual review for major updates.

The author seems open to feature requests as well if there's something extra Auth0 might need in the future. For example, I'm working with him to add a feature that adds a tag after a PR merge (I've been meaning to go back and help some more with that).

Painless Dependency Upgrades with Renovate App is a good start for a comparison.

[luisrudge]

That's great. Let's go with renovate then, but let's keep automerge disabled for now. Can you send a PR with the configuration file to kick things off?

[ScottRudiger]

Will do! 👍