Security updates

[byrond]

Notes

• urijs doesn't appear in yarn.lock but is flagged as a vulnerability in https://github.com/palantirnet/federated-search-react/security/dependabot/yarn.lock/urijs/open. The bot is likely finding the hash on this line as a false positive:

  federated-search-react/yarn.lock

  Line 10111 in d8259bf

  integrity sha512-8QQikdH7//R2vurIJSutZ1smHYTcLpRWEOlHnzcWHmBYrOGUysKwSsrC89BCiFj3CbrfJ/nXFdJepOVrY1GCHQ==

• Updated to react-scripts version 4.0.1 to get
  • node-notifier 8.0.1 (https://github.com/palantirnet/federated-search-react/security/dependabot/yarn.lock/node-notifier/open)
  • node-forge 0.10.0 (https://github.com/palantirnet/federated-search-react/security/dependabot/yarn.lock/node-forge/open)
  • yargs-parser 13.1.2 (https://github.com/palantirnet/federated-search-react/security/dependabot/yarn.lock/yargs-parser/open)
  • serialize-javascript 4.0.0 (https://github.com/palantirnet/federated-search-react/security/dependabot/yarn.lock/serialize-javascript/open)
  • lodash 4.17.20 (https://github.com/palantirnet/federated-search-react/security/dependabot/yarn.lock/lodash/open)
• Updated to patch-package 6.2.2 to get dot-prop 5.3.0 (https://github.com/palantirnet/federated-search-react/security/dependabot/yarn.lock/dot-prop/open)

Testing

• yarn install
• Setup https://github.com/palantirnet/federated-search-demo as directed in the readme there.
• Enable CORS for the D8 demo site by adding the following to services.yml:

  cors.config:
    enabled: true
    # Specify allowed headers, like 'x-allowed-header'.
    allowedHeaders: ['*']
    # Specify allowed request methods, specify ['*'] to allow all possible ones.
    allowedMethods: ['*']
    # Configure requests allowed from specific origins.
    allowedOrigins: ['*']
    # Sets the Access-Control-Expose-Headers header.
    exposedHeaders: false
    # Sets the Access-Control-Max-Age header.
    maxAge: false
    # Sets the Access-Control-Allow-Credentials header.
    supportsCredentials: false

• Create .eslintignore in the root of this project with * as its contents.
• Create .env.local.js from the example file, and update the hostname:

hostname: "d8.fs-demo.local",

• yarn start
• Test the search and facets to verify you see the expected results.

[agentrickard]

I now have these:

Untracked files:
  (use "git add <file>..." to include in what will be committed)
	.eslintcache
	.eslintignore

[byrond]

@agentrickard I added .eslintcache to .gitignore. I am leaving .eslintignore out, since we may need to add one later.

[agentrickard]

This tests correctly both with and without the proxy enabled.

[agentrickard]

@byrond are you doing the linting in this branch or another?

[byrond]

@agentrickard I'm creating a new branch for fixing the linting errors.