Vulnerable dependency reported by NPM audit

[StefanNedelchev]

# npm audit report

semver  <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw

Recently NPM started showing this vulnerability report for libraries that use old versions of semver.

[ljharb]

Like most CVEs, it's a false positive. We're not using new Range nor are we doing anything that wouldn't be a self-attack (ie, not an attack).

We can't ever bump the semver version because v7 drops support for engines we support, so unless the fix is backported to v6, it'll just have to remain a false positive. However, the semver team is indeed backporting it to v6, so you don't have to do anything but wait.

Duplicate of #2803. Duplicate of #2804. Duplicate of #2805. Duplicate of #2806. Duplicate of #2807. Duplicate of #2808. Duplicate of #2809. Duplicate of #2814. Duplicate of #2821. Duplicate of #2822.

[StefanNedelchev]

@ljharb thanks for the explanation and sorry for the duplicate issue. I didn't see an open issue for this but it didn't occur to me to check the closed issues filter.