Fix Regular Expression Denial of Service (ReDoS)

[hubdotcom]

https://snyk.io/vuln/npm:ms:20170412

[coveralls]

Coverage remained the same at 63.804% when pulling d49a69f on hubdotcom:patch-1 into 4a6c85c on visionmedia:master.

[designfrontier]

would love to see this landed :-) I am a way upstream consumer and this is the one open vulnerability I've got at the moment.

[thebigredgeek]

live on https://github.com/visionmedia/debug/releases/tag/2.6.7
@dougwilson

[dotchev]

We also see this issue in our projects. We depend on debug via a bunch of other packages. It will take some time until all of them are updated.
But I wonder if this issue affects debug at al.
Looking quickly in the code, it seems ms is called only with a number, not with a string. So this ReDoS issue should not be relevant, right?

    var ms = curr - (prevTime || curr);
    self.diff = ms;

https://github.com/visionmedia/debug/blob/master/src/debug.js#L73

exports.humanize = require('ms');

https://github.com/visionmedia/debug/blob/master/src/debug.js#L14

    args.push('\u001b[3' + c + 'm+' + exports.humanize(this.diff) + '\u001b[0m');

https://github.com/visionmedia/debug/blob/master/src/node.js#L115