Pin to 1.4.0

Please bear in mind that, since this points to the old repo that's still compromised, it's not impossible to re-tag a new commit. So I think it's a good compromise solution, but probably not the best going forward. But then, that's the bread and butter of development, isn't it?

package.json

@@ -26,7 +26,7 @@
     "prettier": "2.3.2"
   },
   "optionalDependencies": {
-    "@dabh/colors": "^1.1.2"
+    "colors": "1.4.0"
   },
   "scripts": {
     "changelog": "lerna-changelog",