Upgrade to set-value@^4.0.1

[jeffsays]

Summary

resolve CVE-2021-23440 by upgrading set-value to ^4.0.1
resolve CVE-2021-3803 by using CumulusDS/flow-coverage-report

Details

Fixing in upstream dependencies is complicated because of changing semantics in set-value when setting the undefined value on objects.
See jonschlinkert/cache-base#22 (comment)

It is safe enough for us to override the set-value package version using package.json resolutions.

Testing

The set-value dependency only used in the dev infrastructure, not production code. A green build should give us enough confidence to accept this change.

[github-actions]

yarn.lock changes

Summary

Status	Count
	29
	67
	1
	8

Click to toggle table visibility

Name	Status	Previous	Current
@babel/code-frame		7.12.11	7.14.5
@babel/generator		7.12.11	7.15.4
@babel/helper-function-name		7.12.11	7.15.4
@babel/helper-get-function-arity		7.12.10	7.15.4
@babel/helper-hoist-variables		7.0.0	7.15.4
@babel/helper-split-export-declaration		7.12.11	7.15.4
@babel/helper-validator-identifier		7.12.11	7.15.7
@babel/highlight		7.10.4	7.14.5
@babel/parser		7.12.11	7.15.7
@babel/runtime		7.12.5	7.15.4
@babel/template		7.12.7	7.15.4
@babel/types		7.12.12	7.15.6
@cumulusds/badge-up		-	2.3.0
@cumulusds/flow-annotation-check		-	1.11.5
@cumulusds/flow-coverage-report		-	0.8.1
@eslint/eslintrc		-	0.4.3
@humanwhocodes/config-array		-	0.5.0
@humanwhocodes/object-schema		-	1.2.0
@rpl/badge-up		2.2.0	-
@trysound/sax		-	0.2.0
@types/q		1.5.4	-
acorn-jsx		5.3.1	5.3.2
ajv		6.12.6	8.6.3
ansi-colors		-	4.1.1
ansi-regex		5.0.0	5.0.1
argparse		1.0.10	2.0.1
array.prototype.find		2.1.1	2.1.2
astral-regex		1.0.0	2.0.0
call-bind		1.0.0	1.0.2
coa		2.0.2	-
commander		6.2.0	7.2.0
css-color-names		0.0.4	1.0.1
css-select-base-adapter		0.1.1	-
css-select		2.1.0	4.1.3
css-tree		1.1.2	1.1.3
css-what		3.4.2	5.0.1
dom-serializer		0.2.2	1.3.2
domelementtype		2.1.0	2.2.0
domhandler		-	4.2.2
domutils		1.7.0	2.8.0
enquirer		-	2.3.6
entities		2.1.0	2.2.0
es-abstract		1.18.0-next.1	1.19.1
escape-string-regexp		2.0.0	4.0.0
eslint-utils		1.4.3	2.1.0
eslint-visitor-keys		1.3.0	2.1.0
eslint		6.8.0	7.32.0
espree		6.2.1	7.3.1
esquery		1.3.1	1.4.0
file-entry-cache		5.0.1	6.0.1
flat-cache		2.0.1	3.0.4
flatted		2.0.2	3.2.2
flow-annotation-check		1.11.4	-
flow-coverage-report		0.8.0	-
get-intrinsic		1.0.1	1.1.1
get-symbol-description		-	1.0.0
glob		7.1.6	7.2.0
globals		12.4.0	13.11.0
has-bigints		-	1.0.1
has-symbols		1.0.1	1.0.2
has-tostringtag		-	1.0.0
import-fresh		3.2.2	3.3.0
internal-slot		-	1.0.3
is-bigint		-	1.0.4
is-boolean-object		-	1.1.2
is-callable		1.2.2	1.2.4
is-number-object		-	1.0.6
is-primitive		-	3.0.1
is-regex		1.1.1	1.1.4
is-shared-array-buffer		-	1.0.1
is-string		-	1.0.7
is-symbol		1.0.2	1.0.4
is-weakref		-	1.0.1
json-schema-traverse		0.4.1	1.0.0
levn		0.3.0	0.4.1
lodash.clonedeep		-	4.5.0
lodash.merge		-	4.6.2
lodash.truncate		-	4.4.2
nanocolors		-	0.1.12
nth-check		1.0.2	2.0.1
object-inspect		1.9.0	1.11.0
optionator		0.8.3	0.9.1
parse-json		5.1.0	5.2.0
prelude-ls		1.1.2	1.2.1
q		1.5.1	-
regenerator-runtime		0.13.7	0.13.9
regexpp		2.0.1	3.2.0
require-from-string		-	2.0.2
sax		1.2.4	1.2.1
set-value		2.0.1	4.1.0
side-channel		-	1.0.4
slice-ansi		2.1.0	4.0.0
string-width		4.2.0	4.2.3
string.prototype.trimend		1.0.3	1.0.4
string.prototype.trimstart		1.0.3	1.0.4
strip-ansi		6.0.0	6.0.1
svgo		1.3.2	2.7.0
table		5.4.6	6.7.2
type-check		0.3.2	0.4.0
type-fest		0.11.0	0.20.2
unbox-primitive		-	1.0.1
unquote		1.1.1	-
which-boxed-primitive		-	1.0.2
y18n		5.0.5	5.0.8
yargs-parser		20.2.4	20.2.9

[joshuanapoli]

Thank you. Merge away!