semver included as a dependency?

[jdmarshall]

While perusing my secondary dependencies I noticed that pg depends on semver. It looks like back in #657 it was added with no further comment, but in looking through the code I can't see where it's still being used.

[coagmano]

It's being used to check for the right version of pg-native here:
https://github.com/brianc/node-postgres/blob/master/lib/native/index.js#L11

[Starefossen]

Can someone at least update it to version 4.3.2 or greater to get ride of a dead serious Denial of Service attack agains this version of semver.

[brianc]

I updated it - also this library was never at risk of that happening since we don't parse user-supplied versions, only versions of pg that may have been installed. I control those versions & have never used a weird/long semver. Still...glad it showed up & was caught! So, any perceived security risk is no longer there.