updated dependency of semver to the latest version

[fschaeffler]

The currently used version of semver does have a medium-level security issue. Therefore, the dependencies of meteor-dev-bundle had been updated.

	Regular Expression Denial of Service
Name	semver
CVSS	5.3 (Medium)
Installed	4.1.0
Vulnerable	<4.3.2
Patched	4.3.2
Path	meteor-dev-bundle@0.0.0 > semver@4.1.0
More Info	https://nodesecurity.io/advisories/31

[apollo-cla]

@fschaeffler: Thank you for submitting a pull request! Before we can merge it, you'll need to sign the Meteor Contributor Agreement here: https://contribute.meteor.com/

[abernix]

Looking at the commit history I'm fairly sure we can go all the way to 5.3.0. Was there a particular reason you avoided it?

[fschaeffler]

@abernix In order to prevent possible side-effects, I did update the package only up until to first version, when the issue got fixed. But you're right, an update to 5.3.0 does make sense. So I'll update the PR.

[hwillson]

Thanks @fschaeffler, looks good! We're almost LGTM here - we just need to generate and publish a new dev bundle version, and see the tests all pass with that new version, then we'll be good to go ( 👋 MDG 🙂 ).

[fschaeffler]

@hwillson are there any further steps needed from my side for the publish of a new dev bundle version? As this is my first PR into https://github.com/meteor/meteor, I'm not sure what steps are all needed for this to happen.

[hwillson]

No, nothing else is required on your side - the next steps have to be handled by MDG staff (see Submitting "Dev Bundle" Pull Requests for more details). Thanks for asking!

[abernix]

I haven't had a chance to look into it, but I think we need to actually look at the reasoning behind semver410.js (added in 259f90b) before merging this.

[hwillson]

Wow, good catch @abernix! Here are the only differences between semver410.js and semver v4.1.0:

// <METEOR>
// Fool the module system detection code below so that it doesn't
// do anything special.
var exports = SemVer, module = {}, define = {};
// Create a package-private variable.  Can't use SemVer because
// of the code that says `function SemVer(...)` below (implicitly
// declaring a var).  Can't use "semver" because that's a var in
// package-version-parser.js.
SemVer410 = SemVer;
// </METEOR>

So it looks like at one point it was necessary to override semver's default module handling code, to work within Meteor's package system. Digging a bit deeper, it looks like the package-version-parser.js file is being used both by the Meteor Tool and by the package-version-parser package. When used by the Tool the npm based version of semver (from the dev_bundle) is used. When used by the package-version-parser package the overridden version above (via SemVer410) is used.

A lot has changed since this code was put in place, so we should (fingers crossed) be able to adjust things such that the package-version-parser package references the same npm based semver version.

[hwillson]

Quick update here - once #8914 has been merged, we should be all set to continue with this PR.