Should use pinned package dependencies

[dselman]

Bug Report 🐛

To minimise the risk from supply chain attacks we should use pinned package dependencies everywhere.

Expected Behavior

In concerto-core package.json: "yaml": "2.8.3"

Current Behavior

In concerto-core package.json: "yaml": "^2.8.3"

Possible Solution

Use exact package versions.
Make sure that dependabot updates are reviewed and not auto-applied.

Steps to Reproduce

1. Look in package.json

[tusxr]

Hi @dselman! I'd love to work on this issue. I'm new to open source and this looks like a great first contribution. Could I be assigned to it? My plan is to go through all the package.json files in the monorepo and replace ranged versions (^) with exact pinned versions. Let me know if there's anything specific I should watch out for!

[dselman]

Yes please do. I can't assign it to you but if you tag me on the PR I will review and merge.