Security advice semver

[xuelink]

$ npm audit

# npm audit report
semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/simple-update-notifier/node_modules/semver
  simple-update-notifier  1.0.7 - 1.1.0
  Depends on vulnerable versions of semver
  node_modules/simple-update-notifier
    nodemon  2.0.19 - 2.0.22
    Depends on vulnerable versions of simple-update-notifier
    node_modules/@trapezedev/project/node_modules/nodemon

3 moderate severity vulnerabilities

$ npm ls simple-update-notifier
x@0.3.2 /Users/xl/Developer/x/x
└─┬ @capacitor/assets@3.0.4
  └─┬ @trapezedev/project@7.0.10
    └─┬ npm-watch@0.9.0
      └─┬ nodemon@2.0.22
        └── simple-update-notifier@1.1.0

[AntiGuideAkquinet]

This seems to be dependent on ionic-team/trapeze#200

[yndajas]

Could an additional override not be specified here to fix this?

[Yolgie]

the dependency has been fixed upstream with trapeze 7.1.3 so we "just" need to update that here now :)

https://github.com/ionic-team/trapeze/releases/tag/7.1.3

[Yolgie]

had some minutes, created a pull request :)