chore(deps): update dependency jsonpath-plus to 10.0.0 due to vulnerability

[knowacki23]

This is a simple dependency bump of the jsonpath-plus dependency.

This dependency is vulnerable according to Snyk: https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884
As this is a non-major upgrade and I have not seen the vulnerability being mentioned anywhere in the repository I thought I'd open a PR for it.

[P0lip]

Could you please update the lockfile as well?
Also, it'd be good to change the commit title to chore(deps) as this change has no impact on the package code itself as mentiond here.
Nimma no longer relies on jsonpath-plus and we have it listed as a dev dependency only to use in test suites to compare Nimma results with those from jsonpath-plus.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

[knowacki23]

Updated package-lock.json and updated commit and PR titles

[johannesmarx]

Hi @knowacki23, could you please update again?
Your source reports that versions < 10.0.7 are affected. Thanks a lot 👍

[coreydaley]

Wouldn't the semver ^10.0.0 pull in the newest 10.1.0 version? https://classic.yarnpkg.com/lang/en/docs/dependency-versions/#toc-caret-ranges

[johannesmarx]

To make the library build consistent and working with version 10.1.0, package-lock.json should also be updated (again) to show explicitly that it's using a version >= 10.0.7.

[coreydaley]

@johannesmarx I opened #14 with the requested changes.
Based on another pull request from @knowacki23 (asyncapi/parser-js#1056) I don't feel as though they are going to update this one.

[P0lip]

@knowacki23 thanks for the PR.
I decided to drop jsonpath-plus in 17faf59.
It was only a dev dependency that wasn't really needed for anything other than convenience.

[coreydaley]

@P0lip Would you mind doing a new release now that it is removed?

[P0lip]

I don't think we need to.
Let me explain. Nimma wasn't vulnerable. jsonpath-plus was only a dev dependency that was used in one test suite.
In a typical setup, dev dependencies aren't installed when you install an npm package. In other words, when one adds nimma to their project, only astring (the only runtime dep Nimma requires) would be installed apart from nimma itself.
As such, the latest version of nimma should pass scanners that check for outdated/vulnerable dependencies.