dependabot warnings about package

[altano]

We don't need to get into a conversation about whether warnings like this are helpful or not, but they are happening.

My latest one was from pulling in eslint-plugin-package-json, because of this dependency chain:

eslint-plugin-package-json 0.12.0
└─┬ package-json-validator 0.6.3
  └─┬ optimist 0.6.1
    └── minimist 0.0.10

It looks like package-json-validator would benefit from either moving from optimist (deprecated) to directly using an updated version of minimist or switching to something like yargs.