[Backport 1.x] Resolves ansi-regex to v5.0.1

[ZilongX]

Signed-off-by: Zilong Xia zilongx@amazon.com

Description

• Resolves [CVE-2021-3807] by adding a resolution for package ansi-regex to 5.0.1
• This PR is to backport the similar fix in 2.0.0 (Resolves ansi-regex to v5.0.1 #1320) to 1.x

Issues Resolved

Resolves #1084

Check List

• All tests pass
  • yarn test:jest
  • yarn test:jest_integration
  • yarn test:ftr
• New functionality has been documented.
• Commits are signed per the DCO using --signoff

[joshuarrrr]

@ZilongX Did the backport automation fail here? Or did we just never label it appropriately for backport?

[kavilla]

@ZilongX Did the backport automation fail here? Or did we just never label it appropriately for backport?

To be honest, I think it was intentionally not added since plugins might use this package but I dont think the resolutions section should be picked up by the build process we should check.

[ZilongX]

@joshuarrrr, yes the previous fix PR was not labeled for backporting somehow (#1320), since we're still actively consuming v1.3 which makes this CVE fix still needed in 1.x

[ZilongX]

@kavilla , just did a quick search across the whole opensearch-project(https://github.com/search?p=1&q=org%3Aopensearch-project+ansi-regex%40&type=Code) and it turns out only two versions of ansi-regex are currently in use :

• v2.1.1
• v5.0.1

Given there are no breaking changes introduced in from v2.1.1 to v5.0.1, the potential plugin consumption of ansi-regex should be safe from this backporting.

[ZilongX]

@joshuarrrr @kavilla Trying to catch up the release training for 1.3.6 (code freeze EOD tomorrow), appreciating a quick review / feedback on this one (｡•ᴗ-)_

[kristenTian]

@kavilla , just did a quick search across the whole opensearch-project(https://github.com/search?p=1&q=org%3Aopensearch-project+ansi-regex%40&type=Code) and it turns out only two versions of ansi-regex are currently in use :

• v2.1.1
• v5.0.1

Given there are no breaking changes introduced in from v2.1.1 to v5.0.1, the potential plugin consumption of ansi-regex should be safe from this backporting.

Curious to learn, where can verify no breaking changes introduced during these versions?

[kavilla]

Doesn't break the build because the resolutions does not get checked in the dependency checking mechanism.

[joshuarrrr]

@kristenTian My understanding is that one way to manually verify is:

1. Pull down this PR branch
2. Install one of the plugins with an old/non-matching version (such as dashboards-reports
3. Run yarn osd bootstrap to build and check for build errors/failures