AX-4551: Incomplete List of Disallowed Inputs in @babel/traverse

[audiocipher]

This PR is to resolve the critical snyk vulnerability @babel/traverse Incomplete List of Disallowed Inputs.

This vulnerability was introduced through [email protected], [email protected] and resolved by upgrading to @babel/[email protected].

*Note: upgrading to @babel/[email protected] caused errors due to an incompatibility between ember-auto-import and webpack, so an additional change was made to resolve this in ember-cli-build.js.

[ross-tew-expel]

@audiocipher - looking good from a first pass! One thing that comes to mind:

• I'm not sure, but we may need a major release bump for the upgrade of Node 12->16
• See @nabeelz7's comment here on the last PR: PLAID-21: Upgrades async, semver, and loader-utils to latest compatible versions to address Snyk vulnerability #55 (comment)

[nabeelz7]

*Note: upgrading to @babel/[email protected] caused errors due to an incompatibility between ember-auto-import and webpack, so an additional change was made to resolve this in ember-cli-build.js.

Unfortunately due to rebuilding yarn.lock its hard to tell how many changes are being made here. Was upgrading to node 16 required because of @babel/[email protected]. What version of this package is currently there (to see if it was because of a major bump of this package) -- too lazy to check myself.

[audiocipher]

*Note: upgrading to @babel/[email protected] caused errors due to an incompatibility between ember-auto-import and webpack, so an additional change was made to resolve this in ember-cli-build.js.

Unfortunately due to rebuilding yarn.lock its hard to tell how many changes are being made here. Was upgrading to node 16 required because of @babel/[email protected]. What version of this package is currently there (to see if it was because of a major bump of this package) -- too lazy to check myself.

@nabeelz7 @ross-tew-expel
Upgrading to node 16 was required in order to fix the error webpack returned errors to ember-auto-import after bumping the direct dependency [email protected] to [email protected].

In my latest commit I tried only bumping the transitive dependency @babel/[email protected] to @babel/[email protected], but I got the same webpack error described above.

[ross-tew-expel]

👍 Thanks for the additional research, AJ - sounds like this is the best path forward