chore(deps): avoid vulnerable [email protected]

[ddneilson]

Eliminates risk from GHSA-43f8-2h32-f4cj

The package in question is used as a dev dependency in our repository; specifically as transitive dependencies from [email protected] and [email protected]. These are the latest versions of these packages. As a dev dependency, the risk of this CVE is super low -- at worst it's a developer's build taking a little longer than desired. But, better to be safe than sorry.

Changes to our dependency tree

Before

[email protected]
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ └─┬ [email protected]
│ │   ├─┬ [email protected]
│ │   │ ├── [email protected] 
│ │   │ └─┬ [email protected]
│ │   │   └── [email protected]  deduped
│ │   ├─┬ [email protected]
│ │   │ └─┬ [email protected]
│ │   │   └─┬ [email protected]
│ │   │     └── [email protected] 
│ │   └─┬ [email protected]
│ │     └── [email protected] 
│ └─┬ [email protected]
│   ├─┬ [email protected]
│   │ └── [email protected] 
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └─┬ [email protected]
│         └── [email protected] 
└─┬ [email protected]
  ├─┬ @lerna/[email protected]
  │ └─┬ [email protected]
  │   └── [email protected] 
  ├─┬ @lerna/[email protected]
  │ └─┬ [email protected]
  │   └─┬ [email protected]
  │     └─┬ [email protected]
  │       └── [email protected] 
  ├─┬ @lerna/[email protected]
  │ └─┬ @lerna/[email protected]
  │   └─┬ [email protected]
  │     └─┬ [email protected]
  │       └── [email protected] 
  └─┬ @lerna/[email protected]
    └─┬ @lerna/[email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └── [email protected] 

After

[email protected]
├─┬ [email protected]
│ ├─┬ [email protected]
│ │ └─┬ [email protected]
│ │   ├─┬ [email protected]
│ │   │ ├── [email protected] 
│ │   │ └─┬ [email protected]
│ │   │   └── [email protected]  deduped
│ │   ├─┬ [email protected]
│ │   │ └─┬ [email protected]
│ │   │   └─┬ [email protected]
│ │   │     └── [email protected] 
│ │   └─┬ [email protected]
│ │     └── [email protected] 
│ └─┬ [email protected]
│   ├─┬ [email protected]
│   │ └── [email protected] 
│   └─┬ [email protected]
│     └─┬ [email protected]
│       └─┬ [email protected]
│         └── [email protected] 
└─┬ [email protected]
  ├─┬ @lerna/[email protected]
  │ └─┬ [email protected]
  │   └── [email protected] 
  ├─┬ @lerna/[email protected]
  │ └─┬ [email protected]
  │   └─┬ [email protected]
  │     └─┬ [email protected]
  │       └── [email protected] 
  ├─┬ @lerna/[email protected]
  │ └─┬ @lerna/[email protected]
  │   └─┬ [email protected]
  │     └─┬ [email protected]
  │       └── [email protected] 
  └─┬ @lerna/[email protected]
    └─┬ @lerna/[email protected]
      └─┬ [email protected]
        └─┬ [email protected]
          └── [email protected] 

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

[jusiskin]

Good job leaving a breadcrumb trail for future cleanup!