chore: bump execa to v2.1.0 (#32543)

* chore(toolkit): bump execa to v2 to fix vulnerability issue

* chore(toolkit): update usage of execa

packages/grafana-toolkit/package.json

@@ -33,7 +33,6 @@
     "@grafana/tsconfig": "^1.0.0-rc1",
     "@grafana/ui": "7.5.0-pre.0",
     "@types/command-exists": "^1.2.0",
-    "@types/execa": "^0.9.0",
     "@types/expect-puppeteer": "3.3.1",
     "@types/fs-extra": "^8.1.0",
     "@types/inquirer": "^6.0.3",
@@ -63,7 +62,7 @@
     "eslint-plugin-jsdoc": "31.6.1",
     "eslint-plugin-prettier": "3.3.1",
     "eslint-plugin-react-hooks": "4.2.0",
-    "execa": "^1.0.0",
+    "execa": "^2.0.0",
     "expect-puppeteer": "4.1.1",
     "file-loader": "5.0.2",
     "fork-ts-checker-webpack-plugin": "1.0.0",

packages/grafana-toolkit/src/cli/tasks/plugin.utils.ts

@@ -14,14 +14,17 @@ const DEFAULT_EMAIL_ADDRESS = 'eng@grafana.com';
 const DEFAULT_USERNAME = 'CircleCI Automation';
 
 const releaseNotes = async (): Promise<string> => {
-  const { stdout } = await execa.shell(`awk 'BEGIN {FS="##"; RS="##"} FNR==3 {print "##" $1; exit}' CHANGELOG.md`);
+  const { stdout } = await execa(`awk 'BEGIN {FS="##"; RS="##"} FNR==3 {print "##" $1; exit}' CHANGELOG.md`, {
+    shell: true,
+  });
   return stdout;
 };
 
 const checkoutBranch = async (branchName: string): Promise<Command> => {
-  const currentBranch = await execa.shell(`git rev-parse --abbrev-ref HEAD`);
+  const currentBranch = await execa(`git rev-parse --abbrev-ref HEAD`, { shell: true });
-  const branchesAvailable = await execa.shell(
+  const branchesAvailable = await execa(
-    `(git branch -a | grep "${branchName}$" | grep -v remote) || echo 'No release found'`
+    `(git branch -a | grep "${branchName}$" | grep -v remote) || echo 'No release found'`,
+    { shell: true }
   );
 
   if (currentBranch.stdout !== branchName) {

yarn.lock

@@ -5982,13 +5982,6 @@
   resolved "https://registry.yarnpkg.com/@types/events/-/events-3.0.0.tgz#2862f3f58a9a7f7c3e78d79f130dd4d71c25c2a7"
   integrity sha512-EaObqwIvayI5a8dCzhFrjKzVwKLxjoG9T6Ppd5CEo07LRKfQ8Yokw54r5+Wq7FaBQ+yXRvQAYPrHwya1/UFt9g==
 
-"@types/execa@^0.9.0":
-  version "0.9.0"
-  resolved "https://registry.yarnpkg.com/@types/execa/-/execa-0.9.0.tgz#9b025d2755f17e80beaf9368c3f4f319d8b0fb93"
-  integrity sha512-mgfd93RhzjYBUHHV532turHC2j4l/qxsF/PbfDmprHDEUHmNZGlDn1CEsulGK3AfsPdhkWzZQT/S/k0UGhLGsA==
-  dependencies:
-    "@types/node" "*"
-
 "@types/expect-puppeteer@3.3.1":
   version "3.3.1"
   resolved "https://registry.yarnpkg.com/@types/expect-puppeteer/-/expect-puppeteer-3.3.1.tgz#46e5944bf425b86ea13a563c7c8b86901414988d"
@@ -12980,6 +12973,21 @@ execa@^1.0.0:
     signal-exit "^3.0.0"
     strip-eof "^1.0.0"
 
+execa@^2.0.0:
+  version "2.1.0"
+  resolved "https://registry.yarnpkg.com/execa/-/execa-2.1.0.tgz#e5d3ecd837d2a60ec50f3da78fd39767747bbe99"
+  integrity sha512-Y/URAVapfbYy2Xp/gb6A0E7iR8xeqOCXsuuaoMn7A5PzrXUK84E1gyiEfq0wQd/GHA6GsoHWwhNq8anb0mleIw==
+  dependencies:
+    cross-spawn "^7.0.0"
+    get-stream "^5.0.0"
+    is-stream "^2.0.0"
+    merge-stream "^2.0.0"
+    npm-run-path "^3.0.0"
+    onetime "^5.1.0"
+    p-finally "^2.0.0"
+    signal-exit "^3.0.2"
+    strip-final-newline "^2.0.0"
+
 execa@^3.4.0:
   version "3.4.0"
   resolved "https://registry.yarnpkg.com/execa/-/execa-3.4.0.tgz#c08ed4550ef65d858fac269ffc8572446f37eb89"
@@ -18907,6 +18915,13 @@ npm-run-path@^2.0.0:
   dependencies:
     path-key "^2.0.0"
 
+npm-run-path@^3.0.0:
+  version "3.1.0"
+  resolved "https://registry.yarnpkg.com/npm-run-path/-/npm-run-path-3.1.0.tgz#7f91be317f6a466efed3c9f2980ad8a4ee8b0fa5"
+  integrity sha512-Dbl4A/VfiVGLgQv29URL9xshU8XDY1GeLy+fsaZ1AA8JDSfjvr5P5+pzRbWqRSBxk6/DW7MIh8lTM/PaGnP2kg==
+  dependencies:
+    path-key "^3.0.0"
+
 npm-run-path@^4.0.0:
   version "4.0.1"
   resolved "https://registry.yarnpkg.com/npm-run-path/-/npm-run-path-4.0.1.tgz#b7ecd1e5ed53da8e37a55e1c2269e0b97ed748ea"