fix: Bump dot-prop to 5.2.0 (CVE-2020-8116)

[rajivshah3]

Description

Bumps dot-prop to 5.2.0. Versions between 1.0.1 and 5.1.1 are vulnerable to prototype pollution according to Snyk. This could cause Lerna users to have failing dependency audit pipelines.

In dot-prop 5.0.0, support for Node <8 was removed according to the release notes. It doesn't look like there were functional changes in sindresorhus/dot-prop@a19fd41 though. Nonetheless, this could be considered a breaking change, as I noticed the engines field in the package.json says "node": ">= 6.9.0".

Motivation and Context

Fixes #2606
Fixes #2492
Related to #2575

How Has This Been Tested?

• All unit tests pass

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• My code follows the code style of this project.
• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.
• All new and existing tests passed.

[fabb]

npm audit now complains too: https://www.npmjs.com/advisories/1213

please merge and release a new version of lerna.

[NilSet]

There are two additional paths to a vulnerable version of dot-prop in lerna.

lerna > @lerna/version > @lerna/conventional-commits > conventional-changelog-core > conventional-changelog-writer  > compare-func > dot-prop
lerna > @lerna/version > @lerna/conventional-commits > conventional-changelog-angular > compare-func > dot-prop

We probably need to upgrade conventional-changelog-core and conventional-changelog-angular as well.

[AviVahl]

@evocateur any chance you've got time to review this? how can we assist?

[denodaeus]

Can you guys update this? This is a pretty high critical vulnerability in dot-prop:

Issues
Issue ID Issue Type Severity Description Library Name & Version In Use
35847075 Vulnerability 9.8 CVE-2020-8116: Prototype Pollution dot-prop 3.0.0
35847076 Vulnerability 9.8 CVE-2020-8116: Prototype Pollution dot-prop 4.2.0

[evantahler]

Can I help with anything here? This is a pretty big vulnerability that should be updated...

[jimmyandrade]

LGTM

[denodaeus]

Any updates on this, will you be merging this soon?

[nahumzs]

this popped up 17 days ago in my github dependabot alerts, anyway for this to get merge? do any body know what would be the consequences to let github to patch the yarn.lock meanwhile this gets merge? 🙏

[loganwohlers]

Any updates on this? still seeing this issue on dependabot

[evocateur]

v4.0.0 (now available as lerna@next) should resolve this, as we now use dot-prop v6. Thanks for your patience, everyone.