Bump dot-prop and lodash

[lucasponce]

Address a vulnerability detected by github in the 3rd party libraries.

I've addressed this in k-charted as well kiali/k-charted#110.

I'd require more testing, smoke tests seem ok, but these changes may be good if are tested by anyone else as they can easily introduce side effects.

[mtho11]

See comments...

[mtho11]

We should pin to exact version instead of ^

Suggested change

	"dot-prop": "^4.2.1",
	"dot-prop": "4.2.1",

I don't think this is the correct approach to add this as a direct dependency since the UI doesn't use it directly. It is only used by some other packages:

=> Found "dot-prop@4.2.0"
info Reasons this module exists
   - "snyk#configstore" depends on it
   - Hoisted from "snyk#configstore#dot-prop"
   - Hoisted from "react-scripts#optimize-css-assets-webpack-plugin#cssnano#cssnano-preset-default#postcss-merge-rules#postcss-selector-parser#dot-prop"
   - Hoisted from "react-scripts#optimize-css-assets-webpack-plugin#cssnano#cssnano-preset-default#postcss-minify-selectors#postcss-selector-parser#dot-prop"
   - Hoisted from "react-scripts#optimize-css-assets-webpack-plugin#cssnano#cssnano-preset-default#postcss-merge-longhand#stylehacks#postcss-selector-parser#dot-prop"

And even the indirect use of the library is only for dev build stuff (non-runtime). So I think the better way is to add it to the resolutions clause.

[lucasponce]

right, thanks for taking a look

[mtho11]

LGTM

[lucasponce]

@hhovsepy @skondkar this PR should be safe to merge, but would you mind to perform some smoke test on it ?

Bumping dependencies is a way to introduce side effects, probably it's not necessary to run full regressions, just some smoke test in the features to see if there is something odd.

[hhovsepy]

Smoke test pass.