[CVE-2022-25858][1.x]Bump terser from 4.8.0 to 4.8.1

[ananzh]

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 is vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions. Currently, 1.x is using version 4.8.0.

ubuntu@ip-172-31-55-237:~/work/OpenSearch-Dashboards$ yarn why terser
yarn why v1.22.19
[1/4] Why do we have the module "terser"...?
[2/4] Initialising dependency graph...
warning Resolution field "typescript@4.0.2" is incompatible with requested version "typescript@~3.7.2"
warning Resolution field "shelljs@0.8.5" is incompatible with requested version "shelljs@^0.6.0"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "terser@4.8.0"
info Reasons this module exists
   - "_project_#@osd#optimizer#terser-webpack-plugin" depends on it
   - Hoisted from "_project_#@osd#optimizer#terser-webpack-plugin#terser"
   - Hoisted from "_project_#@osd#ui-shared-deps#webpack#terser-webpack-plugin#terser"
info Disk size without dependencies: "1.86MB"
info Disk size with unique dependencies: "2.86MB"
info Disk size with transitive dependencies: "2.88MB"
info Number of shared dependencies: 4
Done in 1.03s.

terser is a dependency of terser-webpack-plugin . We are two versions of terser-webpack-plugin in 1.x, 2.3.7 and 1.4.4.

ubuntu@ip-172-31-55-237:~/work/OpenSearch-Dashboards$ yarn why terser-webpack-plugin
yarn why v1.22.19
[1/4] Why do we have the module "terser-webpack-plugin"...?
[2/4] Initialising dependency graph...
warning Resolution field "typescript@4.0.2" is incompatible with requested version "typescript@~3.7.2"
warning Resolution field "shelljs@0.8.5" is incompatible with requested version "shelljs@^0.6.0"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "terser-webpack-plugin@2.3.7"
info Reasons this module exists
   - "_project_#@osd#optimizer" depends on it
   - Hoisted from "_project_#@osd#optimizer#terser-webpack-plugin"
info Disk size without dependencies: "704KB"
info Disk size with unique dependencies: "4.92MB"
info Disk size with transitive dependencies: "10.18MB"
info Number of shared dependencies: 68
=> Found "webpack#terser-webpack-plugin@1.4.4"
info This module exists because "_project_#@osd#ui-shared-deps#webpack" depends on it.
info Disk size without dependencies: "92KB"
info Disk size with unique dependencies: "3.58MB"
info Disk size with transitive dependencies: "8.13MB"
info Number of shared dependencies: 66
Done in 1.20s.

• terser-webpack-plugin v2.3.7 uses "terser": "^4.6.12" here. The last version on major version 2 is v2.3.8 which also uses the same, see here.
• terser-webpack-plugin v1.4.4 uses "terser": "^4.1.2" here. The last version on major version 1 is v1.4.5 which also uses the same, see here.

Both range of "terser": "^4.6.12" and "terser": "^4.1.2" indicate that terser could be bumped to 4.8.1. The fix is to set a resolution to the target version.

Issues Resolved

#1907

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
  • yarn test:ftr
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[codecov-commenter]

Codecov Report

Merging #3726 (9af4939) into 1.x (53ae3cf) will not change coverage.
The diff coverage is n/a.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@           Coverage Diff           @@
##              1.x    #3726   +/-   ##
=======================================
  Coverage   67.50%   67.50%           
=======================================
  Files        3044     3044           
  Lines       58692    58692           
  Branches     8902     8902           
=======================================
  Hits        39619    39619           
  Misses      16925    16925           
  Partials     2148     2148           

Flag	Coverage Δ
Linux	67.45% <ø> (ø)
Windows	67.45% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.