chore: resolve dependencies CVE

[ncoden]

Update (sub-)dependencies:

• foundation-docs: 856ca90 -> e951418
• supercollider: 1.4.0 -> 1.4.4
• panini: 1.4.0 -> 1.6.2

Resolve sub-dependencies CVE:

• handlebars: 2.0.0-> 4.0.1 (CVE 2015-8861)
• uglify-js: 2.3.6 -> 2.8.29 (CVE 2015-8857, CVE 2015-8858)
• marked: 0.3.6 -> 0.3.14 (CVE 2017-1000427)

See:

• chore: upgrade handlebars to 4.0.11 supercollider#16 chore: upgrade handlebars to 4.0.11 (@DanielRuf)
• chore: resolve marked CVE supercollider#18 chore: chore: resolve marked CVE (@ncoden)
• chore: update marked to 0.3.14 panini#158 chore: upgrade handlebars to 4.0.11 (@DanielRuf)
• chore: update supercollider foundation-docs#27 chore: update supercollider (@ncoden)
• chore: resolve dependencies CVE foundation-docs#28 chore: resolve dependencies CVE (@ncoden)

[DanielRuf]

handlebars ✔️
marked ❌
uglify-js ❌

npm ls handlebars
+-- foundation-docs@0.2.1 (github:zurb/foundation-docs#5bcace3dfdb3e9288744ed0537a9ae0b0a98cce7)
| `-- handlebars@4.0.11
+-- panini@1.6.2
| `-- handlebars@4.0.11  deduped
`-- supercollider@1.4.3
  `-- handlebars@4.0.11  deduped

npm ls marked
+-- foundation-docs@0.2.1 (github:zurb/foundation-docs#5bcace3dfdb3e9288744ed0537a9ae0b0a98cce7)
| `-- marked@0.3.6
+-- octophant@1.0.1
| `-- sassdoc@2.3.0
|   `-- sassdoc-theme-default@2.6.1
|     `-- sassdoc-extras@2.4.1
|       `-- marked@0.3.6  deduped
+-- panini@1.6.2
| `-- marked@0.3.16
`-- supercollider@1.4.3
  +-- jsdoc-api@1.2.4
  | `-- jsdoc-75lb@3.6.0
  |   `-- marked@0.3.6  deduped
  +-- jsdoc3-parser@1.1.0
  | `-- jsdoc@3.5.5
  |   `-- marked@0.3.6  deduped
  `-- marked@0.3.6  deduped

npm ls uglify-js
+-- foundation-docs@0.2.1 (github:zurb/foundation-docs#5bcace3dfdb3e9288744ed0537a9ae0b0a98cce7)
| `-- handlebars@4.0.11
|   `-- uglify-js@2.8.29
+-- gulp-uglify@2.1.2
| `-- uglify-js@2.8.29
+-- octophant@1.0.1
| `-- sassdoc@2.3.0
|   `-- sassdoc-theme-default@2.6.1
|     +-- html-minifier@3.5.5
|     | `-- uglify-js@3.1.3
|     `-- swig@1.4.0
|       `-- uglify-js@2.4.24
+-- webpack@3.5.5
| `-- uglifyjs-webpack-plugin@0.4.6
|   `-- uglify-js@2.8.29
`-- webpack-stream@3.2.0
  `-- webpack@1.15.0
    `-- uglify-js@2.7.5

https://github.com/zurb/foundation-docs/blob/master/package.json#L35

Seems the docs, octophant / sassdoc, jsdoc and supercollider still pull the wrong vulnerable marked version.

And sassdoc still uses uglify-js@2.4.24 in swig (which is not maintained anymore).
https://github.com/paularmstrong/swig/blob/master/package.json#L21

I guess either the lockfiles are not properly updated (npm ls outdated) or we have to change more deps in package.json files.

[DanielRuf]

https://github.com/node-swig/swig-templates could be a solution
SassDoc/sassdoc-theme-default#96

[DanielRuf]

jsdoc-api and jsdoc3-parser are also candidates for updates.

https://github.com/SassDoc/sassdoc-extras/commits/master

[ncoden]

@DanielRuf

• ✅ Resolved with chore: resolve dependencies CVE foundation-docs#28:

  +-- foundation-docs@0.2.1 (github:zurb/foundation-docs#5bcace3dfdb3e9288744ed0537a9ae0b0a98cce7)
  | `-- marked@0.3.6                    --- ^0.3.5 (locked to 0.3.9) -> ^0.3.14 (locked to 0.3.14)
  

• ✅ Resolved with chore: resolve marked CVE supercollider#18 (require chore: resolve dependencies CVE foundation-docs#28):

  +-- foundation-docs@0.2.1 (github:zurb/foundation-docs#5bcace3dfdb3e9288744ed0537a9ae0b0a98cce7)
  | `-- marked@0.3.6                    --- ^0.3.2 -> ^0.3.14 (locked to 0.3.16)
  +-- panini@1.6.2
  | `-- marked@0.3.16
  `-- supercollider@1.4.3
    +-- jsdoc-api@1.2.4
    | `-- jsdoc-75lb@3.6.0
    |   `-- marked@0.3.6               --- ~0.3.6 (unlocked) -> ~0.3.6 (locked to 0.3.14)
    +-- jsdoc3-parser@1.1.0
    | `-- jsdoc@3.5.5
    |   `-- marked@0.3.6               --- ~0.3.6 (unlocked) -> ~0.3.6 (locked to 0.3.14)
    `-- marked@0.3.6                   --- ^0.3.5 (locked to 0.3.9) -> ^0.3.14 (locked to 0.3.14)
  

• ✅ Resolved with an update of package-lock.json

  +-- octophant@1.0.1
  | `-- sassdoc@2.3.0
  |   `-- sassdoc-theme-default@2.6.1
  |     `-- sassdoc-extras@2.4.1
  |       `-- marked@0.3.6              --- ^0.3.9 (unlocked) -> ^0.3.9 (locked to 0.3.14)
  

• ❌ Unresolved:

  +-- octophant@1.0.1
  | `-- sassdoc@2.3.0
  |   `-- sassdoc-theme-default@2.6.1
  |     `-- swig@1.4.0                    --- require `uglify-js@~2.4`
  |       `-- uglify-js@2.4.24
  

But the last one is not a problem as we do not use the SassDoc default theme.

[DanielRuf]

Looks good to me so far (after the new PRs will be applied) 👍

[ncoden]

➜  foundation-sites git:(chore/update-packages-cve) npm ls handlebars marked uglify-js
foundation-sites@6.4.3 /Users/ncoden/Documents/Documents/Projects/Programmation/Web/2016/Foundation/dev/foundation-sites
├─┬ foundation-docs@0.2.1 (github:zurb/foundation-docs#e95141823f1248fd62a83ed5999cdd979cacd9e5)
│ ├─┬ handlebars@4.0.11
│ │ └── uglify-js@2.8.29
│ └── marked@0.3.16
├─┬ gulp-uglify@2.1.2
│ └── uglify-js@2.8.29
├─┬ octophant@1.0.1
│ └─┬ sassdoc@2.3.0
│   └─┬ sassdoc-theme-default@2.6.1
│     ├─┬ html-minifier@3.5.5
│     │ └── uglify-js@3.1.3
│     ├─┬ sassdoc-extras@2.4.1
│     │ └── marked@0.3.16  deduped
│     └─┬ swig@1.4.0
│       └── uglify-js@2.4.24
├─┬ panini@1.6.2
│ ├── handlebars@4.0.11  deduped
│ └── marked@0.3.16
├─┬ supercollider@1.4.4
│ ├── handlebars@4.0.11  deduped
│ ├─┬ jsdoc-api@1.2.4
│ │ └─┬ jsdoc-75lb@3.6.0
│ │   └── marked@0.3.16
│ ├─┬ jsdoc3-parser@1.1.0
│ │ └─┬ jsdoc@3.5.5
│ │   └── marked@0.3.16  deduped
│ └── marked@0.3.16
├─┬ webpack@3.5.5
│ └─┬ uglifyjs-webpack-plugin@0.4.6
│   └── uglify-js@2.8.29
└─┬ webpack-stream@3.2.0
  └─┬ webpack@1.15.0
    └── uglify-js@2.7.5

So LGTM

[DanielRuf]

awesome 👍