Repository: newrelic/node-newrelic (js)

Issue:
Security issue with async: 2.x having a dependency on lodash 4.17.15
Can this module be ported to async 3.x which as 0 production dependency.

3.1.0: https://github.com/caolan/async/blob/master/package.json
2.x: https://github.com/caolan/async/blob/2.x/package.json

```
Source: CERT
Name: https://hackerone.com/reports/712065
Url: https://hackerone.com/reports/712065
```

Pull request:
Issue #343: Upgrade async to 3.2.0
<!--
Thank you for submitting a Pull Request.

This code is leveraged to monitor critical services. Please consider the following:
* Tests are required.
* Performance matters.
* Features that are specific to just your app are unlikely to make it in.

Please fill out the relevant sections as follows:
* Proposed Release Notes: Bulleted list of recommended release notes for the change(s).
* Links: Any relevant links for the change.
* Details: In-depth description of changes, other technical notes, etc.
-->

## Proposed Release Notes

## Links

Closes #343

## Details

Upgraded following [async's release note](https://github.com/caolan/async/blob/master/CHANGELOG.md#v300).

It was surprisingly easy : We only had two test functions in `whilst` that had to be asynchronous.

I didn't know if we supported async/await, so I used old school callbacks. Let me know if you want me to change it to async functions.

Patch:
diff --git a/lib/environment.js b/lib/environment.js
index 8dc8f8a58..35b6766c8 100644
--- a/lib/environment.js
+++ b/lib/environment.js
@@ -228,8 +228,8 @@ function getLocalPackages(callback) {
   var visited = Object.create(null)
   _log('Getting local packages')
 
-  a.whilst(function checkCandidate() {
-    return candidate
+  a.whilst(function checkCandidate(cb) {
+    return cb(null, candidate)
   }, function iterate(cb) {
     _log('Checking for local packages in %s', candidate)
     var root = path.resolve(candidate, 'node_modules')
diff --git a/package-lock.json b/package-lock.json
index 4416b1f1f..12c2b6400 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -396,6 +396,15 @@
         "semver": "^5.5.0"
       },
       "dependencies": {
+        "async": {
+          "version": "2.6.3",
+          "resolved": "https://registry.npmjs.org/async/-/async-2.6.3.tgz",
+          "integrity": "sha512-zflvls11DCy+dQWzTW2dzuilv8Z5X/pjfmZOWba6TNIVDm+2UDaJmXSOXlasHKfNBs8oo3M0aT50fDEWfKZjXg==",
+          "dev": true,
+          "requires": {
+            "lodash": "^4.17.14"
+          }
+        },
         "concat-stream": {
           "version": "1.6.2",
           "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-1.6.2.tgz",
@@ -726,12 +735,9 @@
       "dev": true
     },
     "async": {
-      "version": "2.6.3",
-      "resolved": "https://registry.npmjs.org/async/-/async-2.6.3.tgz",
-      "integrity": "sha512-zflvls11DCy+dQWzTW2dzuilv8Z5X/pjfmZOWba6TNIVDm+2UDaJmXSOXlasHKfNBs8oo3M0aT50fDEWfKZjXg==",
-      "requires": {
-        "lodash": "^4.17.14"
-      }
+      "version": "3.2.0",
+      "resolved": "https://registry.npmjs.org/async/-/async-3.2.0.tgz",
+      "integrity": "sha512-TR2mEZFVOj2pLStYxLht7TyfuRzaydfpxr3k9RpHIzMgw7A64dzsdqCxH1WJyQdoe8T10nDXd9wnEigmiuHIZw=="
     },
     "async-hook-domain": {
       "version": "1.1.3",
@@ -3291,7 +3297,8 @@
     "lodash": {
       "version": "4.17.15",
       "resolved": "https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz",
-      "integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A=="
+      "integrity": "sha512-8xOcRHvCjnocdS5cpwXQXVzmmh5e5+saE2QGoeQmbKmRS6J3VQppPOIt0MnmE+4xlZoumy0GPG0D0MVIQbNA1A==",
+      "dev": true
     },
     "lodash.camelcase": {
       "version": "4.3.0",
diff --git a/package.json b/package.json
index a934a6db3..93a198d53 100644
--- a/package.json
+++ b/package.json
@@ -148,7 +148,7 @@
     "@newrelic/koa": "^4.0.0",
     "@newrelic/superagent": "^3.0.0",
     "@tyriar/fibonacci-heap": "^2.0.7",
-    "async": "^2.1.4",
+    "async": "^3.2.0",
     "concat-stream": "^2.0.0",
     "https-proxy-agent": "^4.0.0",
     "json-stringify-safe": "^5.0.0",


Test patch:
diff --git a/test/integration/instrumentation/oracle.tap.js b/test/integration/instrumentation/oracle.tap.js
index d4023630d..e78fa51f5 100644
--- a/test/integration/instrumentation/oracle.tap.js
+++ b/test/integration/instrumentation/oracle.tap.js
@@ -365,8 +365,8 @@ function nextRowsTest(t) {
       // insert 5 rows
       async.whilst(for5, insert, testRead)
 
-      function for5() {
-        return insertCount < 5
+      function for5(cb) {
+        return cb(null, insertCount < 5)
       }
 
       function insert(callback) {