EREGCSC-1015 Resolve dependabot alerts

[PhilR8]

No description provided.

[PhilR8]

All npm vulnerabilities in ./e2e, ./serverless, and ./serverless/static-assets have been resolved. See screenshots below. You can also pull down this repository and check for yourself by navigating to the folders listed above and running npm audit.

However, once you go into ./regulations/static, things are a bit different. There are a 20+ vulnerabilities, almost all of which are related to storybook.

Here is a GitHub issue where other people are having very similar issues:

storybookjs/storybook#16556

Which then links to an issue with create-react-app (that has a bunch of duplicate issues listed):

facebook/create-react-app#11641

Suffice to say, it's a current and ongoing issue.

However, Dan Abramov (of React/Redux/CreateReactApp renown) has a few things to say about the results of npm audit:

https://overreacted.io/npm-audit-broken-by-design/
facebook/create-react-app#11174

Namely: these are build tool vulnerabilities and are of little consequence.

But isn't this just ignoring the problem?
No.

Create React App is a build tool. In other words, it doesn't produce a running Node application. It runs at the build time during development, and produces static assets.

However, npm audit is designed for Node apps so it flags issues that can occur when you run actual Node code in production. That is categorically not how Create React App works.

The resolution proposed by Dan Abramov is to move all build tool packages into devDependencies and run:

npm audit --production

And that should return zero vulnerabilities.

In our case, this meant migrating storybook to use Webpack5. Once finished, Storybook runs as expected, and running npm audit --production returns zero vulnerabilities. See screenshot below:

[PhilR8]

moving Storybook to latest version and migrating to webpack 5

[knollfear]

LGTM!. Thanks for doing the research into this.