security(deps): bump filenamify-url to 2.1.1

[AviVahl]

regenerated lock file from scratch to get back to 0 vulnerabilities

fixes:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ normalize-url                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=4.5.1 <5.0.0 || >=5.3.1 <6.0.0 || >=6.0.1                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ gh-pages                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ gh-pages > filenamify-url > humanize-url > normalize-url     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1755                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[TyMick]

For what it's worth, the only breaking change in filenamify-url v2 is that it requires Node.js 8, so no other code changes should be necessary. 👍🏼

[TyMick]

Though I'm not sure that regenerating the lockfile was necessary—npm install filenamify-url@2 probably would've been sufficient to upgrade normalize-url.

[AviVahl]

Though I'm not sure that regenerating the lockfile was necessary—npm install filenamify-url@2 probably would've been sufficient to upgrade normalize-url.

There were other audit failures from locked deps.

[emilbader]

Related issue: sindresorhus/filenamify-url#9
Related commit in humanize-url: sindresorhus/humanize-url@d013ec7

[AviVahl]

heya @tschaub, any chance you've got time to review this? :)

[tschaub]

Thanks, @AviVahl.

There are automated security updates configured for this repo, but they can take up to 7 days from the time of an alert. The alert for normalize-url was still only 6 days old.

[skratchdot]

I think this change broke our ci.

we clone our repo via something like:

[email protected]:org/repo.git

our ci job now fails during a gh-pages step with the following error:

Invalid URL: http:[email protected]:org/repo.git