CCD-7013 :: bumped qs to ^6.14.1 (#519)

* bumped qs to ^6.14.1

* updated yarn.lock via yarn install command

* Update redis from 20.13.4 to 24.0.8

* Bumping chart version/ fixing aliases

---------

Co-authored-by: JamesCollettCGI <james.collett@hmcts.net>
Co-authored-by: hmcts-jenkins-a-to-c <62422075+hmcts-jenkins-a-to-c[bot]@users.noreply.github.com>
Co-authored-by: Hemanth Potipati <hrpotipati@gmail.com>

Author: 4 people

charts/ccd-case-activity-api/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 description: Helm chart for the HMCTS CCD Case Activity
 name: ccd-case-activity-api
 home: https://github.com/hmcts/ccd-case-activity-api
-version: 1.3.14
+version: 1.3.15
 maintainers:
   - name: HMCTS CCD Dev Team
     email: ccd-devops@HMCTS.NET
@@ -11,6 +11,6 @@ dependencies:
     version: 3.2.0
     repository: 'oci://hmctspublic.azurecr.io/helm'
   - name: redis
-    version: 20.13.4
+    version: 24.0.8
     repository: "oci://registry-1.docker.io/bitnamicharts"
     condition: redis.enabled

package-lock.json

@@ -79,6 +79,9 @@
     "sonar-scanner": "^3.1.0",
     "supertest": "^3.0.0"
   },
+  "overrides": {
+    "qs": "6.14.1"
+  },
   "resolutions": {
     "async": "^2.6.4",
     "lodash": "^4.17.21",
@@ -98,7 +101,7 @@
     "minimatch": "^3.0.5",
     "cookiejar": "^2.1.4",
     "flat": "^5.0.1",
-    "qs": "^6.11.0",
+    "qs": "6.14.1",
     "semver": "7.7.2",
     "@grpc/grpc-js": "1.13.4",
     "cross-spawn": "^7.0.6"

package.json

@@ -3,4 +3,3 @@
 {"value":"lodash","children":{"ID":1112455,"Issue":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","URL":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","Severity":"moderate","Vulnerable Versions":">=4.0.0 <=4.17.22","Tree Versions":["4.17.21"],"Dependents":["@hmcts/properties-volume@npm:0.0.14"]}}
 {"value":"lodash.clone","children":{"ID":"lodash.clone (deprecation)","Issue":"This package is deprecated. Use structuredClone instead.","Severity":"moderate","Vulnerable Versions":"4.5.0","Tree Versions":["4.5.0"],"Dependents":["ioredis@npm:3.2.2"]}}
 {"value":"lodash.pick","children":{"ID":"lodash.pick (deprecation)","Issue":"This package is deprecated. Use destructuring assignment syntax instead.","Severity":"moderate","Vulnerable Versions":"3.1.0","Tree Versions":["3.1.0"],"Dependents":["ioredis@npm:3.2.2"]}}
-{"value":"qs","children":{"ID":1111755,"Issue":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","URL":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","Severity":"high","Vulnerable Versions":"<6.14.1","Tree Versions":["6.14.0"],"Dependents":["body-parser@npm:1.20.3"]}}