Companion depends on two modules with moderate CVEs

[martinstreicher]

uppy-companion % npm audit 
# npm audit report

redis  2.6.0 - 3.1.0
Potential exponential regex in monitor mode - https://github.com/advisories/GHSA-35q2-47q7-3pc3
fix available via `npm audit fix --force`
Will install @uppy/[email protected], which is a breaking change
node_modules/node-redis-pubsub/node_modules/redis
  node-redis-pubsub  1.0.3 - 4.0.0
  Depends on vulnerable versions of redis
  node_modules/node-redis-pubsub
    @uppy/companion  *
    Depends on vulnerable versions of node-redis-pubsub
    Depends on vulnerable versions of validator
    node_modules/@uppy/companion

validator  <=13.6.0
Severity: moderate
Inefficient Regular Expression Complexity in validator.js - https://github.com/advisories/GHSA-qgmg-gppg-76g5
 Inefficient Regular Expression Complexity in Validator.js - https://github.com/advisories/GHSA-xx4c-jj58-r7x6
fix available via `npm audit fix --force`
Will install @uppy/[email protected], which is a breaking change
node_modules/validator
  @uppy/companion  *
  Depends on vulnerable versions of node-redis-pubsub
  Depends on vulnerable versions of validator
  node_modules/@uppy/companion

4 vulnerabilities (2 low, 2 moderate)

To address all issues (including breaking changes), run:
  npm audit fix --force

[mifi]

I just checked and it seems our validator version is no longer vulnerable:

companion mifi$ corepack yarn npm audit
└─ redis: 2.8.0
   ├─ Issue: Potential exponential regex in monitor mode
   ├─ URL: https://github.com/advisories/GHSA-35q2-47q7-3pc3
   ├─ Severity: low
   ├─ Vulnerable Versions: >=2.6.0 <3.1.1
   ├─ Patched Versions: >=3.1.1
   ├─ Via: redis
   └─ Recommendation: Upgrade to version 3.1.1 or later

will create a PR for redis
thanks!