[security] Open OSS CVEs

[prabhu]

CVEs from the latest scan:

CVE	Package	Justification
CVE-2021-21306	pkg:npm/[email protected]	code_not_present
CVE-2022-21681	pkg:npm/[email protected]	code_not_present
CVE-2022-21680	pkg:npm/[email protected]	code_not_present
CVE-2022-33987	pkg:npm/[email protected]	code_not_reachable

docsify is a dev dependency used for generating documentation. A indirect dependency called marked has 3 CVEs which can be ignored since we ignore dev dependencies.

got 14.2.1 is used by cdxgen. However, version 9.6.0 is pulled as a dependency of package-json.

npm ls [email protected]
@cyclonedx/[email protected] /Volumes/Work/CycloneDX/cdxgen
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ [email protected]
      └─┬ [email protected]
        └── [email protected]

To reduce the false positives, we can pass --required-only to trim the optional dependencies here. We may have to think about a replacement for docsify, since it appears like the security vulnerabilities are being ignored.