chore: address audit findings

[louib]

This is the full audit finding:

Vulnerability Found:

  Severity: HIGH
  Modules: lerna>@npmcli/run-script>node-gyp>tar, lerna>@lerna/create>@npmcli/run-script>node-gyp>tar, lerna>@npmcli/run-script>node-gyp>make-fetch-happen>cacache>tar, lerna>@lerna/create>@npmcli/run-script>node-gyp>make-fetch-happen>cacache>tar, lerna>@lerna/create>pacote>@npmcli/run-script>node-gyp>make-fetch-happen>cacache>tar, lerna>@npmcli/arborist>@npmcli/metavuln-calculator>pacote>@npmcli/run-script>node-gyp>make-fetch-happen>cacache>tar, lerna>@lerna/create>@npmcli/arborist>@npmcli/metavuln-calculator>pacote>@npmcli/run-script>node-gyp>make-fetch-happen>cacache>tar, lerna>@npmcli/arborist>@npmcli/metavuln-calculator>pacote>tar, lerna>@lerna/create>@npmcli/arborist>@npmcli/metavuln-calculator>pacote>tar, lerna>@npmcli/arborist>cacache>tar, lerna>@lerna/create>@npmcli/arborist>cacache>tar, lerna>@npmcli/arborist>npm-registry-fetch>make-fetch-happen>cacache>tar, lerna>@lerna/create>@npmcli/arborist>npm-registry-fetch>make-fetch-happen>cacache>tar, lerna>libnpmpublish>npm-registry-fetch>make-fetch-happen>cacache>tar, lerna>@lerna/create>libnpmpublish>npm-registry-fetch>make-fetch-happen>cacache>tar, lerna>@lerna/create>libnpmpublish>sigstore>@sigstore/sign>make-fetch-happen>cacache>tar, lerna>@lerna/create>libnpmpublish>sigstore>@sigstore/tuf>tuf-js>make-fetch-happen>cacache>tar, lerna>pacote>tar, lerna>@lerna/create>pacote>tar, lerna>tar, lerna>@lerna/create>tar, yeoman-generator>pacote>cacache>tar, yeoman-generator>pacote>@npmcli/run-script>node-gyp>tar, yeoman-generator>pacote>npm-registry-fetch>make-fetch-happen>cacache>tar, yeoman-generator>pacote>@npmcli/run-script>node-gyp>make-fetch-happen>cacache>tar, yeoman-generator>pacote>sigstore>@sigstore/tuf>tuf-js>make-fetch-happen>cacache>tar, lerna>libnpmaccess>npm-registry-fetch>make-fetch-happen>cacache>tar
  URL: https://github.com/advisories/GHSA-83g3-92jg-28cx

As for the jspdf update, we are requesting an exception since it addresses another high severity finding:

Vulnerability Found:

  Severity: HIGH
  Modules: @bitgo/key-card>jspdf, @bitgo/web-demo>@bitgo/key-card>jspdf
  URL: https://github.com/advisories/GHSA-67pg-wm7f-q7fj

TICKET: WP-7983

[bhargavirao24]

The vulnerabilities in jspdf are generally triggered by user controlled input to addImage or addJS.
I reviewed and merging jspdf 4.2.0 should be fine, and the risk is low.

Please loop us in if any new PR is created by the code owners and they run into blockers.