CVE-2020-28502: xmlhttprequest-ssl-1.5.5.tgz

[jeklein]

Vulnerability registered for nested dependency with xmlhttprequest-ssl-1.5.5. Upgrade to 1.7.0 should remediate.

I can work on the PR, but if someone gets it sooner, great.

Additional Data

Dependency map:
@serverless/components-3.7.7.tgz

 -> platform-client-china-2.1.9.tgz

   -> utils-china-1.0.14.tgz

     -> socket.io-client-2.4.0.tgz

       -> engine.io-client-3.5.1.tgz

         -> xmlhttprequest-ssl-1.5.5.tgz

[flisboac]

There is an advisory for that: https://npmjs.com/advisories/1665.

[KilleRBBC]

There is an issue in the utils-china package which seems to be related, and should fix the upstream dependency chain if resolved, as well.
https://github.com/serverlessinc/utils-china/issues/73

[cschroedl-gov]

Relates to serverless/serverless#9431