Transitive dependency vulnerabilities: lodash (critical), url-parse (critical), uuid (moderate)

[arobson]

npm audit against a fresh install of rabbot@2.1.0 reports 8 vulnerabilities (2 critical, 6 moderate), all transitive:

lodash <=4.17.23 (critical) — via machina, monologue.js, riveter
  - Prototype Pollution (GHSA-fvqr-27wr-82fm, GHSA-4xc9-xhrj-v574, GHSA-jf85-cpcp-j695, GHSA-p6mc-m468-83gw, GHSA-f23m-r3pf-42rh)
  - Command Injection (GHSA-35jh-r3h4-6jhm)

url-parse <=1.5.8 (critical) — via amqplib
  - Authorization Bypass (GHSA-hgjh-723h-mx2j, GHSA-rqff-837h-mm52)
  - Open redirect (GHSA-hh27-ffr2-f2jc)
  - Path traversal (GHSA-9m6j-fcg5-2442)
  - Hostname/protocol parsing issues (GHSA-jf5r-8hm2-f872)
  - '@' parsing issue (GHSA-8v38-pw62-9cw2)

uuid <11.1.1 (moderate) — direct dependency
  - Missing buffer bounds check (GHSA-w5hq-g745-h8pq)

Resolved versions in the dependency tree (npm ls lodash url-parse uuid):

rabbot@2.1.0
├─┬ amqplib@0.5.6
│ └── url-parse@1.4.7
├─┬ machina@2.0.2
│ └── lodash@3.10.1
├─┬ monologue.js@0.3.5
│ ├── lodash@3.10.1 deduped
│ └─┬ riveter@0.2.0
│   └── lodash@2.4.2
├─┬ postal@2.0.6
│ └── lodash@4.18.1
└── uuid@3.4.0

npm audit fix --force offers a fix by downgrading to rabbot@1.0.6, which is a breaking change and not something we want to take blindly. Filing this primarily to have it tracked upstream — happy to help test a patch release if one's feasible (e.g. bumping amqplib's pinned url-parse range, or nudging machina/monologue.js/riveter to versions with a patched lodash).