Update git-url-parse to fix parse-url vulnerability

parse-url is a dependency of git-up which is a dependency of git-url-parse which is a dependency of lerna. parse-url has the following file protocol spoofing vulnerability: https://huntr.dev/bounties/52060edb-e426-431b-a0d0-e70407e44f18/.

parse-url has been updated to 8.0.0 to fix the vulnerability but introduces breaking changes. https://github.com/IonicaBizau/parse-url/releases git-up has been updated to 7.0.0 to include the parse-url changes. https://github.com/IonicaBizau/git-up/releases git-url-parse has been updated to 13.0.0 to include the parse-url changes. https://github.com/IonicaBizau/git-url-parse/releases

Please update to git-url-parse 13.0.0 or greater.

Steps to Reproduce

N/A

Environment

N/A

[timbomckay]

It looks like this dependency is primarily used in the createRelease function to get the repo name & owner. The parse-url breaking changes appear to be primarily regarding the resource & host properties.

My guess is it’d be safe to use overrides for learn. Though I might specify that in the tree so it’s clear which dependency you’re providing an override for lerna to know to check when lerna does release an update.

"overrides": {
    "lerna": {
        "git-url-parse": "13.0.0"
    }
}

[mattrunyon]

parse-url@8.1.0 is the version with the vulnerability patched, so what’s the issue?