CVE-2021-23382 issue in the 2.3 release and earlier

[keithchong]

Checklist:

• I've searched in the docs and FAQ for my answer: https://bit.ly/argocd-faq.
• I've included steps to reproduce the bug.
• I've pasted the output of argocd version.

Describe the bug

See sasstools/scss-tokenizer#45
https://security.snyk.io/vuln/SNYK-JS-SCSSTOKENIZER-2339884

In release-2.3, Argo CD includes node-sass which depends on sass-graph which depends on scss-tokenizer. The version of scss-tokenizer that includes the fix is v0.4.3

Note that in release-2.4, the node-sass dependency was changed to sass via #8884

Version

release-2.3 and earlier

Steps:

Just look at the yarn.lock for nodes-sass, sass-graph, and scss-tokenizer.

[keithchong]

OTOH, it's a dev dependency

[blakepettersson]

Don't think this one's so relevant anymore 😄