Address vulnerable dependencies

[carterworks]

Description

The latest run of the OWASP Dependency Check tool, on which this ticket is based, shows some things that need to be addressed.

Major changes

• Migrated the sandbox from the deprecated create-react-app/`react-scripts to Vite.
• Removed the unused request dependency from Alloy.
• Migrated src/utils/parseUrl.js off of the vulnerable parse-uri

Remaining vulnerabilities

• async:2.6.4 & async:3.2.3
  • v3.2.6 is a dependency of vitest (our unit testing framework) and v2.6.4 is a dependency of the testcafe-browser-provider-saucelabs (what connects our functional test framework to our browser automation hosting). It is a Regex Denial of Service vulnerability. Since they are in our testing frameworks, the worst that could happen is that our tests hang.
• esbuild:0.24.2
  • This is a dependency of vite (the build tool the sandbox now uses) and of vitest (which uses vitest internally). According to the vite team, this vulnerability in esbuild does not affect vite.
• graphql:16.10.0
  • "A vulnerability was found in GraphQL due to improper access controls on the GraphQL introspection query. This flaw allows unauthorized users to retrieve a comprehensive list of available queries and mutations."
  • graphql is a dependency of the @vitest/coverage dependency for our unit tests. This is not a vulnerable part of the application
  • Additionally, the graphql team says that this is a mistaken vulnerability and does not apply to their project

Related Issue

PDCL-12965: AEP WebSDK - Outdated Vulnerable Software - Critical (9.8)
Closes #1231

Motivation and Context

Screenshots (if appropriate):

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Improvement (non-breaking change which does not add functionality)
• Breaking change (fix or feature that would cause existing functionality to change)

Checklist:

• I have signed the Adobe Open Source CLA or I'm an Adobe employee.
• I have made any necessary test changes and all tests pass.
• I have run the Sandbox successfully.