build(deps): bump dependencies

[rdwz]

npm audit report

braces <3.0.3
Severity: high
Uncontrolled resource consumption in braces - GHSA-grv7-fg5c-xmjg
fix available via npm audit fix
node_modules/braces

cross-spawn 7.0.0 - 7.0.4
Severity: high
Regular Expression Denial of Service (ReDoS) in cross-spawn - GHSA-3xgq-45jj-v275
fix available via npm audit fix
node_modules/cross-spawn

micromatch <4.0.8
Severity: moderate
Regular Expression Denial of Service (ReDoS) in micromatch - GHSA-952p-6rrq-rcjv
fix available via npm audit fix
node_modules/micromatch

3 vulnerabilities (1 moderate, 2 high)

[shadowspawn]

I'll close this for a couple of reasons.

There is a new release on the way, and I am not planning to land any more development dependency updates before that. See: #2293 #2295

It is hard to review a large diff to package-lock.json so I prefer updates to multiple packages, like in this PR, are done by a maintainer.

(You may or may not have realised but Commander does not have production dependencies, so these audit warnings do not affect consumers of the Commander package.)