Pin dependency on `colors` package to version 1.4.0

What is the problem?

The NPM package colors prints to the console in an infinite loop that leads to a crash for any version > 1.4.0.

See https://github.com/Marak/colors.js/issues/285 and https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

What do you expect to happen instead?

No infinite loop. The dependency on colors should be pinned to 1.4.0 exactly instead of: https://github.com/winstonjs/winston/blob/65ab472f54906c72c6c72cffc0a12c9f1d0fe995/package.json#L46

[DABH]

No worries, I accept payment in GitHub follows or something 😅 v3.3.4 is out now which mitigates this. Hopefully doing it as a patch version gets this fix out to as many Winston users as possible asap. I’ll continue working with the appropriate folks for the next couple days about resolving the long-term stewardship of colors, but meanwhile, rest assured Winston is ok.

[arthurfiorette]

Also, add

{
  "resolution": {
    "colors": "1.4.0"
  }
}

to the package.json to prevent other dependencies from requiring them too.