chore: resolve shin and urijs vulnerabilities

[kleyow]

mojaloop/project#2354

https://github.com/Mermade/shins is no longer being supported so theres no nice solution to the vulnerability other than permanently ignore it for now.
I don't see an easy way to update shins to https://github.com/Mermade/reslate either.

[mdebarros]

mojaloop/project#2354

https://github.com/Mermade/shins is no longer being supported so theres no nice solution to the vulnerability other than permanently ignore it for now.
I don't see an easy way to update shins to https://github.com/Mermade/reslate either.

Thanks, @kleyow.

The issue is that this needs to be addressed on all projects that have a dependency on @mojaloop/central-services-shared, and ignoring that here will unfortunately not fix that going forward if the dependency tree is generated in those down-stream projects.

Thus I do not believe this PR will fix the issue going forward unless you feel otherwise?

I think we only really have two options here:

1. replacing shins with reslate; or
2. replace the current dev-documentation framework with another solution.

Looping in @vijayg10 for his comments.

[kleyow]

Sorry. I meant to allude to that the vulnerabilties in shin/widershin would need to be ignored permanently in all down-stream projects until a proper fix is in place.

Correct. Those two options are the only ways forward to properly address the vulnerabilities.
I'm on leave atm so when @vijayg10 chimes in we can decide on how this needs to proceed.

[vijayg10]

If reslate can be used to replace shins, then that's easier option.
But I think we can invest some time and investigate if there are any advanced libraries for this purpose.

[mdebarros]

nk

If reslate can be used to replace shins, then that's easier option.
But I think we can invest some time and investigate if there are any advanced libraries for this purpose.

I agree.

Replacing Shins with Reslate would be the first option.

[kleyow]

Just reiterating that I don't think upgrading to reslate will be trivial. Theres no documentation about upgrading and it doesn't export any similar functions to shins afaik.

Pulling mojaloop/project#2354 back into the backlog since I've been pulled onto other urgent work.

If anyone wants to tackle the upgrade or moving to a different documentation framework, feel free to take this issue.