fix: solve audit errors

[pinussilvestrus]

• executed npm audit fix

Which issue does this PR address?

Related to #609

Acceptance Criteria

• Corresponds to the concept
• Corresponds to the design

Definition of Done

• corresponds to the design principles
• corresponds to the code standards
• passes Continuous Integration checks
• available as feature branch on GitHub
  • contains the cleaned up commit history
  • commit messages satisfy our commit message guidelines
  • a single commit closes the issue via Closes #issuenr

[pinussilvestrus]

Executing npm audit fix seems to not do the trick, since there are still issues open, also the ones mentioned in #609 (as far I can overview it). That's very likely due to the multi-package structure of this project.

Proposal:

• Let's discuss a basic strategy regarding those security vulnerabilities issues coming from other libraries
• Investigate which security issues we want to fix

[pinussilvestrus]

I verified the two issues described in #609 with the sync CLI

Issues with no direct upgrade or patch:
  ✗ Prototype Pollution [Medium Severity][https://snyk.io/vuln/SNYK-JS-MINIMIST-559764] in minimist@1.2.0
    introduced by dmn-js@9.4.0 > dmn-js-shared@9.4.0 > inferno@5.0.6 > opencollective@1.0.3 > minimist@1.2.0 and 5 other path(s)
  This issue was fixed in versions: 0.2.1, 1.2.3
  ✗ Denial of Service [Medium Severity][https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311] in node-fetch@1.6.3
    introduced by dmn-js@9.4.0 > dmn-js-shared@9.4.0 > inferno@5.0.6 > opencollective@1.0.3 > node-fetch@1.6.3 and 5 other path(s)
  This issue was fixed in versions: 2.6.1, 3.0.0-beta.9

Seems like these are coming from inferno, which we can't update currently.

[nikku]

That opencollective thing is an actual run-time dependency, via inferno: https://github.com/infernojs/inferno/blob/v5.0.6/packages/inferno/package.json#L54.

To fix it, we'd need to patch inferno to not use the broken (and outdated) library.

[pinussilvestrus]

Let's close this one to keep our board clean and do proper housekeeping later on (e.g. by also cleaning up the sub-packages).