process: replace json-rpc2 with vscode-jsonrpc

[ramya-rao-a]

From microsoft/vscode-go#2861 by @OneOfOne:

┏━ oneofone@voyager ❰~/c/v/vscode-go❱ ❰master|✚2❱
┗━● npm audit

=== npm audit security report ===                        

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.5                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ json-rpc2                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ json-rpc2 > lodash                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/577                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.11                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ json-rpc2                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ json-rpc2 > lodash                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/782                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ lodash                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.17.12                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ json-rpc2                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ json-rpc2 > lodash                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1065                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 3 vulnerabilities (1 low, 2 high) in 441 scanned packages
3 vulnerabilities require manual review. See the full report for details.

[ramya-rao-a]

We depend on json-rpc2 for the debugging feature that is provided by this extension which in turn depends on v3 of lodash resulting in the above warnings.

Unfortunately, json-rpc2 has not had a release in years.

One option would be to fork the package and update the dependency ourselves.

We could try and see if the vscode-jsonrpc can be a good replacement here

cc @quoctruong

[gopherbot]

Change https://golang.org/cl/241557 mentions this issue: package.json: update json-rpc2 and lodash for security update

[hyangah]

The vulnerability issue was resolved with the latest json-rpc2 release.

I looked into this issue over the last week and found vscode-jsonrpc is not compatible with Delve's JSON RPC.

Delve's json-rpc is not a JSON RPC over HTTP as clearly stated in https://github.com/go-delve/delve/tree/master/Documentation/api/json-rpc#json-rpc-interface. On the other hand vscode-jsonrpc assumes a HTTP header included in each message when operating over socket or stdin/out - as assumed in all the JSON RPCs vscode use. (e.g. LSP, DAP). Delve crashes upon receiving the HTTP header info vscode-jsonrpc.

I couldn't find any other convincing, mature alternative javascript library, and Delve DAP implementation that uses compatible framing (https://github.com/google/go-dap/blob/master/io.go ) is around the corner. So I will just close this.

[ramya-rao-a]

Sounds good, did not realize that json-rpc2 had released an update!