[Task](juno): Fix high and medium vulnerabilities

[guoda-puidokaite]

[guoda-puidokaite]

Update

license-checker-rseidelsohn: 4.4.2 introduces a high severity vulnerability (command injection) through glob: 10.4.5, a transitive dependency.

Problem:

• Can’t upgrade license-checker-rseidelsohn as we're using the latest version.
• glob isn't a direct dependency of license-checker-rseidelsohn. license-checker-rseidelsohn uses read-installed-packages uses read-package-json which uses glob. We can't override the version of any in-between dependencies, as the latest versions currently still contain the problematic version of glob.
• Last license-checker-rseidelsohn: 4.4.2 was a year ago. It doesn't seem to be maintained often e.g. from comments in the library. It also uses deprecated read-package-json: 6.0.4.

Solutions

Overriding (Proposed in last maintenance meeting)

• We can override the version of glob in package.json.
• However, this can only be done globally in package.json (without manual lock file manipulation).
• Since it's used by a few other libraries too, if this is an acceptable solution, we need to assess which version we could override to and the compatibility/risk of this. However, this doesn't seem like a stable long-term solution., keeping in mind that license-checker-rseidelsohn isn't maintained often.

Otherwise:

• request an update to the library(ies)
• find a manual solution
  • forking
  • our own solution for lisence checking
  • etc.