Fix security vulnerabilities

[SimmonsRitchie]

What's this PR do?

Fixes an array of vulnerabilities recommended by Dependabot, including:

Bump vue and vue-template-compiler

Bump decode-uri-component from 0.2.0 to 0.2.2

Bump qs from 6.10.1 to 6.11.0

Bump jsonwebtoken from 8.5.1 to 9.0.0

Bump @babel/core from 7.15.8 to 7.20.12

Bump json5 from 1.0.1 to 1.0.2

Bump redis from 3.5.3 to 4.4.2

Bump flask-wtf from 0.15.1 to 1.1.1

Bump cookiejar from 2.1.3 to 2.1.4

Why are we doing this? How does it help us?

Good to stay on top of dependency upgrades for security!

Here are some major upgrades of note:

redis 4.4.2

The breaking changes in Redis 4 don't seem to affect this app:

• Improvements to JSON coverage (Improvements to JSON coverage redis/redis-py#1666)
  Impact: JSON commands available since 4.0.0beta3 now better match RedisJSON
• Add python_requires setuptools check for python > 3.6 (Add python_requires setuptools check for python > 3.6 redis/redis-py#1656)
• Removed support for end of life Python 2.7. Remove support for end-of-life Python 2.7 redis/redis-py#1318
• All values within Redis URLs are unquoted via
  urllib.parse.unquote. Prior versions of redis-py supported this by
  specifying the decode_components flag to the from_url functions.
  This is now done by default and cannot be disabled. Allow URL encoded parameters in Redis URLs by Default redis/redis-py#589
• Redis commands were moved into a mixin
  (see commands.py). Anyone importing redis.client to access commands
  directly should import redis.commands. Migrating commands to a mixin redis/redis-py#1534, Merged new sentinel commands from #834 redis/redis-py#1550

flask-wtf 1.1.1

Flask-wtf v1 doesn't appear to have any breaking changes when migrating from 0.15.1. Support for python 3.6 was dropped in v1.1, but we're using python 3.9 in this repo so it doesn't affect us.

jsonwebtoken 9.0.0

None of the breaking changes appear to affect us:

• Removed support for Node versions 11 and below.
• The verify() function no longer accepts unsigned tokens by default.
• RSA key size must be 2048 bits or greater.
• Asymmetric keys cannot be used to sign & verify HMAC tokens.
• Key types must be valid for the signing / verification algorithm

How should this be manually tested?

Spin up the donations app and:

• Confirm logging into the portal works for both staff and non-staff
• Confirm you can update profile info in the portal
• Confirm you can successfully make a donation

How should this change be communicated to end users?

Are there any smells or added technical debt to note?

At time of writing, this PR does not address all Dependabot recommended fixes but we have quite a few. I thought it might be best to handle them in batches.

What are the relevant tickets?

Have you done the following, if applicable:

(optional: add explanation between parentheses)

• Added automated tests? ( )
• Tested manually on mobile? ( )
• Checked BrowserStack? ( )
• Checked for performance implications? ( )
• Checked accessibility? ( )
• Checked for security implications? ( )
• Updated the documentation/wiki? ( )

TODOs / next steps:

• your TODO here

[ashley-hebler]

All the functionality worked for me. I'm nervous that this includes some major version bumps. Not to say we shouldn't do them, but just curious if you were able to look into any of the implications there?

I remember @erxclau had a good process for this where he'd check in on what each dependency did for us and cross referenced that with the release notes. It's fortunate that the upgrades in this PR don't require any code changes, but it'd still be nice to know a little background on some of the bigger changes so we know we're looking in the right place for bugs.

[ashley-hebler]

Just did a quick check by pushing to staging and all seems to WFM!