Vulnerable Node.js Dependencies

[EricR]

Description

The following two Node.js dependencies are outdated contain known vulnerabilities:

• All versions of web3 are affected by insecure credential storage (see https://www.npmjs.com/advisories/877)
• handlebars < 4.5.2 is affected by arbitrary code execution (see https://www.npmjs.com/advisories/1316)

Because these dependencies are only used within a developer environment, this issue is considered informational.

Recommendation

Short term, upgrade the handlebars library to the latest version. In addition, consider using an alternative to web3 until a patch is made available.

Long term, integrate tools such as npm audit and yarn audit into Balancer's CI pipeline so that vulnerabilities can be caught before code changes are pushed.

[mikemcdonald]

handlebars is a dependency of solidity-coverage -> istanbul which doesn't look like will be updated gotwarlost/istanbul#920

Since this is only for running tests in a dev environment, will mark as won't fix.

I will add yarn audit to the pipelines for any of the frontend dapps: balancer-exchange and balancer-dapp