Security advice semver

[xuelink]

$ npm audit

# npm audit report
semver  7.0.0 - 7.5.1
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
fix available via `npm audit fix`
node_modules/simple-update-notifier/node_modules/semver
  simple-update-notifier  1.0.7 - 1.1.0
  Depends on vulnerable versions of semver
  node_modules/simple-update-notifier
    nodemon  2.0.19 - 2.0.22
    Depends on vulnerable versions of simple-update-notifier
    node_modules/@trapezedev/project/node_modules/nodemon

3 moderate severity vulnerabilities

$ npm ls simple-update-notifier
x@0.3.2 /Users/xl/Developer/x/x
└─┬ @capacitor/assets@3.0.4
  └─┬ @trapezedev/project@7.0.10
    └─┬ npm-watch@0.9.0
      └─┬ nodemon@2.0.22
        └── simple-update-notifier@1.1.0

[AntiGuideAkquinet]

This seems to be dependent on ionic-team/trapeze#200