Diagnostics package creates transient dependency related to CVE-2021-29060

Please tell us about your environment:

• winston version?
  • winston@2
  • winston@3

What is the problem?

Winston has a transient dependency on color-string@1.5.4 which has a ReDOS advisory CVE-2021-29060

└─┬ winston@3.3.3
  └─┬ @dabh/diagnostics@2.0.2
    └─┬ colorspace@1.1.2
      └─┬ color@3.0.0
        └── color-string@1.5.4 

What do you expect to happen instead?

The diagnostics package has not been updated in three years, it may be time to consider an alternate, forking and inlining… etc.

[rcollette]

@wbt - I think with 3.3.4 released, this issue can be closed.

[wbt]

Tagging @DABH as a possibly easier PR route might be an update to that package.