chore(deps-dev): bump json from 9.0.6 to 10.0.0

[dependabot-preview]

Bumps json from 9.0.6 to 10.0.0.

Changelog

Sourced from json's changelog.

10.0.0

• Backward incompatible and security-related change to parsing "lookup" strings.

  This version restricts the supported syntax for bracketed "lookup" strings to fix a possible vulnerability (CVE-2020-7712). With a carefully crafted lookup string, command injection was possible. See #144 for a repro. If you use json (the CLI or as a node.js module) and run arbitrary user-provided strings as a "lookup", then you should upgrade.

  For the json CLI, a "lookup" string is the 'foo' in:

    echo ...some json... | json foo
  

  which allows you to lookup fields on the given JSON, e.g.:

    $ echo '{"foo": {"bar": "baz"}}' | json foo.bar
    baz
  

  If one of the lookup fields isn't a valid JS identifier, then the JS array notation is supported:

    $ echo '{"http://example.com": "my-value"}' | json '["http://example.com"]'
    my-value
  

  Before this change, json would effectively exec the string between the brackets as JS code such that things like the following were possible:

    $ echo '{"foo3": "bar"}' | json '["foo" + 3]'
    bar
  

  This change limits supported bracket syntax in lookups to a simple quoted string:

    ["..."]
    ['...']
    [`...`]      # no variable interpolation
  

  Otherwise generating an error of the form:

    json: error: invalid bracketed lookup string: "[\"foo\" + 3]" (must be of the form ['...'], ["..."], or [`...`])
  

Commits

• cc47981 BREAKING CHANGE: limit syntax for bracketed lookup strings to fix vuln (#145)
• 8d3cf25 Update README.md
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot will not automatically merge this PR because it includes an out-of-range update to a development dependency.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Automerge options (never/patch/minor, and dev/runtime dependencies)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #277.