Upgrade vulnerable node-forge to 0.10.0

[yurloc]

JIRA

Referenced pull requests

How to retest this PR or trigger a specific build:

• for a pull request build please add comment: Jenkins retest this
• for a full downstream build please add comment: Jenkins run fdb
• for a compile downstream build please add comment: Jenkins run cdb
• for a full production downstream build please add comment: Jenkins execute product fdb
• for an upstream build please add comment: Jenkins run upstream

[Christopher-Chianelli]

I don't see any changes to package.json, only package-lock.json. Is this an update of one of our dependencies' dependencies (i.e. not one of our dependencies, but one we inherited)? If not (i.e. it is one of our dependencies), I prefer package.json to be updated to reflect the version change (npm developers don't always respect minor = no breaking changes, and it be easier to look up the issue if we had the actual version being used in package.json). If not (transitive dependency), this is fine (although the dependency that introduce it wasn't updated).

[Christopher-Chianelli]

SonarCloud Code Analysis went to the OptaPlanner PR (https://github.com/kiegroup/optaplanner/pull/393): https://sonarcloud.io/dashboard?id=org.optaplanner%3Aoptaplanner&pullRequest=393

[sonarcloud]

Kudos, SonarCloud Quality Gate passed!

0 Bugs
0 Vulnerabilities (and 0 Security Hotspots to review)
0 Code Smells

No Coverage information
No Duplication information

The version of Node.js (v8.12.0) you have used to run this analysis is deprecated and we will stop accepting it from 16th November 2020. Please update to at least Node.js 10. Read more here

[yurloc]

@Christopher-Chianelli looks good?

[Christopher-Chianelli]

@yurloc see my comment from my review. If it an update to a dependency dependency, it good, if it an update to a direct dependency, I would prefer it to be reflected also in package.json (so we can easily look up any issues with the package)

[yurloc]

@Christopher-Chianelli good question. The change in package-lock.json is a result of running npm audit fix, which was a recommendation I got after running npm audit. I think it makes sense because node-forge is not my direct dependency so I shouldn't enforce its version in package.json but I can still fine-tune the dependency tree by changing package-lock.json.