Bump artifact package version to v0.5.2

[brcrista]

Last version: #761

Changes since last version:

• Re-enable the audit tools step and update dependencies #815 (no change in functionality to artifact)
• Retry artifact uploads on HTTP 500 #833

[konradpabjan]

👍 LGTM

The audit workflow is failing but we can put out a separate PR to bump up the lerna package. It was recently re-enabled so we should make sure to keep that green as soon as possible

[brcrista]

@konradpabjan sounds like we should merge that first before releasing a new version of any packages. I'll give that a try.

[brcrista]

It looks like there is no existing version of lerna with a fix for this. There's an open issue: lerna/lerna#2925

I see the vulnerability is fixed in new versions of trim-newlines and meow but it will need to bubble up a few levels to get to lerna:

───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ trim-newlines                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.0.1 <4.0.0 || >=4.0.1                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ lerna [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ lerna > @lerna/publish > @lerna/version >                    │
│               │ @lerna/conventional-commits > conventional-changelog-core >  │
│               │ get-pkg-repo > meow > trim-newlines                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1753                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ trim-newlines                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.0.1 <4.0.0 || >=4.0.1                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ lerna [dev]                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ lerna > @lerna/version > @lerna/conventional-commits >       │
│               │ conventional-changelog-core > get-pkg-repo > meow >          │
│               │ trim-newlines                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1753                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

We could look into submitting fixes, but lerna is only a dev dependency for us. The vulnerability is a ReDoS, so that doesn't apply to us unless we start DoS'ing our own build process.

@thboop would you be ok with setting up an allow list for https://github.com/actions/toolkit/blob/main/.github/workflows/audit.yml to work around this?

[thboop]

@thboop would you be ok with setting up an allow list for https://github.com/actions/toolkit/blob/main/.github/workflows/audit.yml to work around this?

Go for it 👍