normalize-url security vuln - update package-json to v6

[ntucker]

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ normalize-url │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.5.1 <5.0.0 || >=5.3.1 <6.0.0 || >=6.0.1 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ yo │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ yo > package-json > got > cacheable-request > │
│ │ normalize-url │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1755 │
└───────────────┴──────────────────────────────────────────────────────────────┘

https://github.com/sindresorhus/package-json/releases/tag/v6.0.0 - should be pretty easy given the only breaking change is node 8 req which is already true for yo

[Logicer16]

Currently waiting on a new release of got. See sindresorhus/got#1466

Just noticed got@9.6.0 uses the patched version of normalize-url. I'll open a pr.

[Logicer16]

I think it's been fixed upstream

[JoshuaKGoldberg]

For future reference: https://www.joshuakgoldberg.com/blog/please-stop-sending-me-nested-dependency-security-reports