THRIFT-4757: fix npm identified security vulnerability in transient dependency on sync-exec

3 files changed, 82 insertions, 52 deletions

diff --git a/lib/ts/Makefile.am b/lib/ts/Makefile.am
index 9ea20a4ab..62ea2069f 100644
--- a/lib/ts/Makefile.am
+++ b/lib/ts/Makefile.am
@@ -21,10 +21,38 @@
 # We call install twice to work around npm issues
 #
 if HAVE_NPM
-SUBDIRS = test
 
-check-local: all
+prereq:
 	$(NPM) install || $(NPM) install
 	$(NPM) list
+
+check-local: prereq all
 	./node_modules/.bin/grunt
+
+doc: prereq
+	./node_modules/.bin/grunt jsdoc
+
 endif
+
+clean-local:
+	$(RM) -r dist
+	$(RM) -r doc
+	$(RM) -r node_modules
+	$(RM) -r test/build/
+	$(RM) -r test/gen-*/
+
+dist-hook:
+	$(RM) -r $(distdir)/dist/
+	$(RM) -r $(distdir)/doc/
+	$(RM) -r $(distdir)/node_modules/
+	$(RM) -r $(distdir)/test/build/
+	$(RM) -r $(distdir)/test/gen-*/
+
+EXTRA_DIST = \
+    coding_standards.md \
+    Gruntfile.js \
+    package.json \
+    package-lock.json \
+    thrift.d.ts \
+    tsconfig.json
+
diff --git a/lib/ts/package-lock.json b/lib/ts/package-lock.json
index a7dec9dd3..8d0a7ff2f 100644
--- a/lib/ts/package-lock.json
+++ b/lib/ts/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "thrift",
-  "version": "1.0.0",
+  "version": "0.13.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -26,9 +26,9 @@
       "dev": true
     },
     "@types/qunit": {
-      "version": "2.5.3",
-      "resolved": "https://registry.npmjs.org/@types/qunit/-/qunit-2.5.3.tgz",
-      "integrity": "sha512-b9xNH1wBOnY+yiCT2DiAC0yi7GCF5g6whiAFA/dpd9RtL/Jn2XR7e4yyeAQwH3TUeF00zikmYqYxS0K8+EKTKQ==",
+      "version": "2.5.4",
+      "resolved": "https://registry.npmjs.org/@types/qunit/-/qunit-2.5.4.tgz",
+      "integrity": "sha512-VHi2lEd4/zp8OOouf43JXGJJ5ZxHvdLL1dU0Yakp6Iy73SjpuXl7yjwAwmh1qhTv8krDgHteSwaySr++uXX9YQ==",
       "dev": true
     },
     "JSONStream": {
@@ -1300,7 +1300,7 @@
     },
     "es6-promisify": {
       "version": "5.0.0",
-      "resolved": "http://registry.npmjs.org/es6-promisify/-/es6-promisify-5.0.0.tgz",
+      "resolved": "https://registry.npmjs.org/es6-promisify/-/es6-promisify-5.0.0.tgz",
       "integrity": "sha1-UQnWLz5W6pZ8S2NQWu8IKRyKUgM=",
       "dev": true,
       "requires": {
@@ -1927,14 +1927,14 @@
       }
     },
     "grunt-contrib-qunit": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/grunt-contrib-qunit/-/grunt-contrib-qunit-3.0.1.tgz",
-      "integrity": "sha512-s994+ipKwc+oUUIWaGIw1soyID4pExSGMd/cHQN5h0p8KbIjR1Le3ZC3giSDDKXtZFE0i+Obf0uIjNvjftX2Cw==",
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/grunt-contrib-qunit/-/grunt-contrib-qunit-3.1.0.tgz",
+      "integrity": "sha512-mdk8UltH6mxCD63E0hTXMAts42DOi4z4bBBrY7qnuHiShflMF7IueSMYe0zWaZ2dO8mgujh57Zfny2EbigJhRg==",
       "dev": true,
       "requires": {
         "eventemitter2": "^5.0.1",
         "p-each-series": "^1.0.0",
-        "puppeteer": "1.7.0"
+        "puppeteer": "^1.11.0"
       },
       "dependencies": {
         "eventemitter2": {
@@ -2048,13 +2048,12 @@
       }
     },
     "grunt-shell-spawn": {
-      "version": "0.3.10",
-      "resolved": "https://registry.npmjs.org/grunt-shell-spawn/-/grunt-shell-spawn-0.3.10.tgz",
-      "integrity": "sha1-gbuNRX7EfTGCqH1jCO+EXd+5SI8=",
+      "version": "0.3.12",
+      "resolved": "https://registry.npmjs.org/grunt-shell-spawn/-/grunt-shell-spawn-0.3.12.tgz",
+      "integrity": "sha512-TprZct92sQ4M2Q92piaeLsCrx4+gq/ageuxjZsRG6cglKt7x7rGA3YHt8D30+G789v+/pw4l0tDjEyrkMXx2tA==",
       "dev": true,
       "requires": {
-        "grunt": ">=0.4.x",
-        "sync-exec": "~0.6.2"
+        "grunt": ">=0.4.x"
       }
     },
     "gzip-size": {
@@ -2719,9 +2718,9 @@
       }
     },
     "json-int64": {
-      "version": "0.0.3",
-      "resolved": "https://registry.npmjs.org/json-int64/-/json-int64-0.0.3.tgz",
-      "integrity": "sha512-6nAloOVry+klkifPKPqFLX/FI4L95oBfu5T5vKKt4L8gik8cy80wOtzC+kM1Vh2r60QdDqDr7u/XVk6VlfueEg==",
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/json-int64/-/json-int64-1.0.0.tgz",
+      "integrity": "sha512-yrTg9swToElhEPETLMdZkEzDhbXLs+cxkw/b2rglMPOBlM1DE0utH1EReSMLcnpYJk5iUvD12r0fP2/xHitF5Q==",
       "requires": {
         "node-int64": "0.4.0"
       }
@@ -2970,7 +2969,7 @@
     },
     "marked": {
       "version": "0.3.19",
-      "resolved": "http://registry.npmjs.org/marked/-/marked-0.3.19.tgz",
+      "resolved": "https://registry.npmjs.org/marked/-/marked-0.3.19.tgz",
       "integrity": "sha512-ea2eGWOqNxPcXv8dyERdSr/6FmzvWwzjMxpfGB/sbMccXoct+xY+YukPD+QTUZwyvK7BZwcr4m21WBOW41pAkg=="
     },
     "maxmin": {
@@ -3353,12 +3352,12 @@
     },
     "os-homedir": {
       "version": "1.0.2",
-      "resolved": "http://registry.npmjs.org/os-homedir/-/os-homedir-1.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/os-homedir/-/os-homedir-1.0.2.tgz",
       "integrity": "sha1-/7xJiDNuDoM94MFox+8VISGqf7M="
     },
     "os-tmpdir": {
       "version": "1.0.2",
-      "resolved": "http://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz",
+      "resolved": "https://registry.npmjs.org/os-tmpdir/-/os-tmpdir-1.0.2.tgz",
       "integrity": "sha1-u+Z0BseaqFxc/sdm/lc0VV36EnQ="
     },
     "osenv": {
@@ -3659,25 +3658,25 @@
       "dev": true
     },
     "puppeteer": {
-      "version": "1.7.0",
-      "resolved": "https://registry.npmjs.org/puppeteer/-/puppeteer-1.7.0.tgz",
-      "integrity": "sha512-f+1DxKHPqce6CXUBz2eVO2WcATeVeQSOPG9GYaGObEZDCiCEUwG+gogjMsrvn7he2wHTqNVb5p6RUrwmr8XFBA==",
+      "version": "1.11.0",
+      "resolved": "https://registry.npmjs.org/puppeteer/-/puppeteer-1.11.0.tgz",
+      "integrity": "sha512-iG4iMOHixc2EpzqRV+pv7o3GgmU2dNYEMkvKwSaQO/vMZURakwSOn/EYJ6OIRFYOque1qorzIBvrytPIQB3YzQ==",
       "dev": true,
       "requires": {
-        "debug": "^3.1.0",
+        "debug": "^4.1.0",
         "extract-zip": "^1.6.6",
         "https-proxy-agent": "^2.2.1",
         "mime": "^2.0.3",
-        "progress": "^2.0.0",
+        "progress": "^2.0.1",
         "proxy-from-env": "^1.0.0",
         "rimraf": "^2.6.1",
-        "ws": "^5.1.1"
+        "ws": "^6.1.0"
       },
       "dependencies": {
         "debug": {
-          "version": "3.2.6",
-          "resolved": "https://registry.npmjs.org/debug/-/debug-3.2.6.tgz",
-          "integrity": "sha512-mel+jf7nrtEl5Pn1Qx46zARXKDpBbvzezse7p7LqINmdoIk8PYP5SySaxEmYv6TZ0JyEKA1hsCId6DIhgITtWQ==",
+          "version": "4.1.1",
+          "resolved": "https://registry.npmjs.org/debug/-/debug-4.1.1.tgz",
+          "integrity": "sha512-pYAIzeRo8J6KPEaJ0VWOh5Pzkbw/RetuzehGM7QRRX5he4fPHx2rdKMB256ehJCkX+XRQm16eZLqLNS8RSZXZw==",
           "dev": true,
           "requires": {
             "ms": "^2.1.1"
@@ -3881,7 +3880,7 @@
       "dependencies": {
         "underscore": {
           "version": "1.6.0",
-          "resolved": "http://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz",
+          "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz",
           "integrity": "sha1-izixDKze9jM3uLJOT/htRa6lKag="
         }
       }
@@ -4419,12 +4418,6 @@
         "has-flag": "^3.0.0"
       }
     },
-    "sync-exec": {
-      "version": "0.6.2",
-      "resolved": "https://registry.npmjs.org/sync-exec/-/sync-exec-0.6.2.tgz",
-      "integrity": "sha1-cX0izFPwzh3vVZQ2LzqJouu5EQU=",
-      "dev": true
-    },
     "syntax-error": {
       "version": "1.4.0",
       "resolved": "http://registry.npmjs.org/syntax-error/-/syntax-error-1.4.0.tgz",
@@ -4574,9 +4567,9 @@
       "dev": true
     },
     "typescript": {
-      "version": "3.2.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.2.2.tgz",
-      "integrity": "sha512-VCj5UiSyHBjwfYacmDuc/NOk4QQixbE+Wn7MFJuS0nRuPQbof132Pw4u53dm264O8LPc2MVsc7RJNml5szurkg==",
+      "version": "3.2.4",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-3.2.4.tgz",
+      "integrity": "sha512-0RNDbSdEokBeEAkgNbxJ+BLwSManFy9TeXz8uW+48j/xhEXv1ePME60olyzw2XzUqUBNAYFeJadIqAgNqIACwg==",
       "dev": true
     },
     "uglify-js": {
@@ -4631,7 +4624,7 @@
     },
     "underscore": {
       "version": "1.8.3",
-      "resolved": "http://registry.npmjs.org/underscore/-/underscore-1.8.3.tgz",
+      "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.8.3.tgz",
       "integrity": "sha1-Tz+1OxBuYJf8+ctBCfKl6b36UCI="
     },
     "underscore-contrib": {
@@ -4644,7 +4637,7 @@
       "dependencies": {
         "underscore": {
           "version": "1.6.0",
-          "resolved": "http://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz",
+          "resolved": "https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz",
           "integrity": "sha1-izixDKze9jM3uLJOT/htRa6lKag="
         }
       }
@@ -4910,9 +4903,9 @@
       "dev": true
     },
     "ws": {
-      "version": "5.2.2",
-      "resolved": "https://registry.npmjs.org/ws/-/ws-5.2.2.tgz",
-      "integrity": "sha512-jaHFD6PFv6UgoIVda6qZllptQsMlDEJkTQcybzzXDYM1XO9Y8em691FGMPmM46WGyLU4z9KMgQN+qrux/nhlHA==",
+      "version": "6.1.3",
+      "resolved": "https://registry.npmjs.org/ws/-/ws-6.1.3.tgz",
+      "integrity": "sha512-tbSxiT+qJI223AP4iLfQbkbxkwdFcneYinM2+x46Gx2wgvbaOMO36czfdfVUBRTHvzAMRhDd98sA5d/BuWbQdg==",
       "dev": true,
       "requires": {
         "async-limiter": "~1.0.0"
diff --git a/lib/ts/package.json b/lib/ts/package.json
index 1a1ccdc85..eda1c0aea 100644
--- a/lib/ts/package.json
+++ b/lib/ts/package.json
@@ -1,24 +1,33 @@
 {
   "name": "thrift",
-  "version": "1.0.0",
+  "version": "0.13.0",
+  "description": "Thrift is a software framework for scalable cross-language services development.",
+  "author": {
+    "name": "Apache Thrift Developers",
+    "email": "dev@thrift.apache.org"
+  },
+  "bugs": "https://issues.apache.org/jira/projects/THRIFT/summary",
+  "homepage": "http://thrift.apache.org",
+  "repository": "https://github.com/apache/thrift",
+  "license": "Apache-2.0",
   "devDependencies": {
     "@types/node-int64": "^0.4.29",
     "@types/phantom": "^3.2.5",
-    "@types/qunit": "^2.5.3",
+    "@types/qunit": "^2.5.4",
     "browserify": "^16.2.3",
     "bufferutil": "^4.0.1",
-    "grunt": "^1.0.2",
+    "grunt": "^1.0.3",
     "grunt-cli": "^1.2.0",
     "grunt-contrib-concat": "^1.0.1",
     "grunt-contrib-jshint": "^1.0.0",
-    "grunt-contrib-qunit": "^3.0.1",
+    "grunt-contrib-qunit": "^3.1.0",
     "grunt-contrib-uglify": "^1.0.1",
     "grunt-jsdoc": "^2.2.1",
-    "grunt-shell-spawn": "^0.3.10",
+    "grunt-shell-spawn": "^0.3.12",
     "jslint": "^0.12.0",
     "node-int64": "^0.4.0",
     "phantom": "^6.0.3",
-    "typescript": "^3.2.2"
+    "typescript": "^3.2.4"
   },
   "dependencies": {
     "bufferutil": "^4.0.1",