[1.3] Bump yo from 2.0.6 to 3.1.1

[ananzh]

With the SemVer philosophy, when releasing a patch version, it should not introduce breaking changes, which includes bumping a dependency to its major version.

yo is a dev dependency in package @osd/ui-framework for OSD. Meanwhile, it is not included in release artifact. Therefore, bumping major versions should not break SemVer rules.

Description

Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). mem is brought into OSD by yo#fullname:

ubuntu@ip-**:~/OpenSearch-Dashboards$ yarn why mem
yarn why v1.22.19
[1/4] Why do we have the module "mem"...?
[2/4] Initialising dependency graph...
warning Resolution field "typescript@4.0.2" is incompatible with requested version "typescript@~4.8.4"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "mem@1.1.0"
info Reasons this module exists
   - "_project_#@osd#ui-framework#yo#fullname" depends on it
   - Hoisted from "_project_#@osd#ui-framework#yo#fullname#mem"
info Disk size without dependencies: "16KB"
info Disk size with unique dependencies: "32KB"
info Disk size with transitive dependencies: "32KB"
info Number of shared dependencies: 1
=> Found "os-locale#mem@4.0.0"
info This module exists because "_project_#@osd#pm#webpack-cli#yargs#os-locale" depends on it.
info Disk size without dependencies: "16KB"
info Disk size with unique dependencies: "72KB"
info Disk size with transitive dependencies: "88KB"
info Number of shared dependencies: 3
Done in 1.05s.

There are two options to solve the issue:

• fullname needs and could be bumped to 4.0.0: sindresorhus/fullname@v3.3.0...v4.0.0
• yo needs and could be bumped to 3.1.1: yeoman/yo@v2.0.6...v3.1.0

No breaking changes from either option. Choose to bump yo.

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
  • yarn test:ftr
• New functionality includes testing.
• New functionality has been documented.
• Update CHANGELOG.md
• Commits are signed per the DCO using --signoff

[codecov]

Codecov Report

Merging #5005 (fff504d) into 1.3 (7b922e8) will increase coverage by 0.04%.
Report is 2 commits behind head on 1.3.
The diff coverage is n/a.

❗ Current head fff504d differs from pull request most recent head 454072d. Consider uploading reports for the commit 454072d to get more accurate results

@@            Coverage Diff             @@
##              1.3    #5005      +/-   ##
==========================================
+ Coverage   67.46%   67.50%   +0.04%     
==========================================
  Files        3044     3044              
  Lines       58692    58692              
  Branches     8902     8902              
==========================================
+ Hits        39595    39619      +24     
+ Misses      16945    16925      -20     
+ Partials     2152     2148       -4     

Flag	Coverage Δ
Linux	67.45% <ø> (-0.01%)	⬇️
Windows	67.45% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

see 5 files with indirect coverage changes

[joshuarrrr]

You're still including mem 4.0.0 here. I believe you'll also need to upgrade fullname, as you mentioned in the description.

[ananzh]

Versions of mem prior to 4.0.0 are vulnerable to Denial of Service (DoS). So 4.0.0 is fine. It is brought in from another package

ubuntu@ip-**:~/OpenSearch-Dashboards$ yarn why mem
yarn why v1.22.19
[1/4] Why do we have the module "mem"...?
[2/4] Initialising dependency graph...
warning Resolution field "typescript@4.0.2" is incompatible with requested version "typescript@~4.8.4"
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "mem@1.1.0"
info Reasons this module exists
   - "_project_#@osd#ui-framework#yo#fullname" depends on it
   - Hoisted from "_project_#@osd#ui-framework#yo#fullname#mem"
info Disk size without dependencies: "16KB"
info Disk size with unique dependencies: "32KB"
info Disk size with transitive dependencies: "32KB"
info Number of shared dependencies: 1
=> Found "os-locale#mem@4.0.0"
info This module exists because "_project_#@osd#pm#webpack-cli#yargs#os-locale" depends on it.
info Disk size without dependencies: "16KB"
info Disk size with unique dependencies: "72KB"
info Disk size with transitive dependencies: "88KB"
info Number of shared dependencies: 3
Done in 1.05s.

I only resolve the affected mem@1.1.0.

[joshuarrrr]

Looks good, assuming tests pass.