thenify before 3.3.1 made use of unsafe calls to eval.

[gitstart-sourcegraph]

Problem statement

Versions of thenify prior to 3.3.1 made use of unsafe calls to eval. Untrusted user input could thus lead to arbitrary code execution on the host. The patch in version 3.3.1 removes calls to eval.

Success criteria

Update thenify to a non-vulnerable version

Implementation details

The latest possible version of thenify that can be installed is 3.3.0.
The earliest fixed version is 3.3.1.

• Affected versions < 3.3.1

Ref

#35989
Link to dependabot alert

Time estimate

• Pull requests with ~450 lines changed should take 3 hours at maximum. Ping the reviewer in the spec pull request if time-consuming changes are required.
• Split the work into multiple pull requests if the total diff is bigger than 450 lines of code.

[sourcegraph-bot-2]

Heads up @taylorsperry @jasongornall - the "team/frontend-platform" label was applied to this issue.

[gitstart-app]

Here is the GitStart Ticket for this issue: https://app.gitstart.com/clients/sourcegraph/tickets/SG-39076

[gitstart-sourcegraph]

Closing this: --> #39212 (comment)