Bump the version of json5 from 1.0.1 to 1.0.2

[RyanL1997]

Signed-off-by: Ryan Liang jiallian@amazon.com

Description

Bump the version of json5 from 1.0.1 to 1.0.2

Category

Maintenance

Issues Resolved

• Relate CVE-2022-46175 (High) detected in json5-1.0.1.tgz, json5-2.2.1.tgz - autoclosed OpenSearch-Dashboards#3148

Testing

[Please provide details of testing done: unit testing, integration testing and manual testing]

Check List

• New functionality includes testing
• New functionality has been documented
• Commits are signed per the DCO using --signoff

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

[RyanL1997]

This PR is blocked by the version update of 1.3.8. Once the version increment is done I will re-run the integ test.

[cwperks]

@RyanL1997 It won't be fixed until the security plugin is incremented to 1.3.8 and added to the build manifest. This PR (opensearch-project/security#2344) needs to be merged, but its currently blocked by failing plugin install workflow which is because the version increment is not being applied to all necessary files.

[peternied]

Dashboards is still on version 1.0.1 per their package.json in branch 1.3 [1]. As this is a transitive dependency should we wait for the issue to be fixed in their 1.3 branch?

• [1] https://github.com/opensearch-project/OpenSearch-Dashboards/blob/5516d61ac6a3d08a2344fb64ff8a0128adc8008f/package.json#L420

[RyanL1997]

Dashboards is still on version 1.0.1 per their package.json in branch 1.3 [1]. As this is a transitive dependency should we wait for the issue to be fixed in their 1.3 branch?

• [1] https://github.com/opensearch-project/OpenSearch-Dashboards/blob/5516d61ac6a3d08a2344fb64ff8a0128adc8008f/package.json#L420

@peternied Got it! I will track this PR (opensearch-project/OpenSearch-Dashboards#3201), and once it gets merged and backported, let's do this one.

[RyanL1997]

Closing this one, since the latest CVE fix for 1.3 branch has removed the json5 dependency: #1308