@vscode/vsce has a dependecy on vulnerable versions of parse-semver and semver

[ogretmenb]

There is another issue regarding semver version
#874

but parse-semver also depends on a vulnerable version of semver

npm audit report

semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - GHSA-c2qf-rxjj-qqgw
No fix available
node_modules/@vscode/vsce/node_modules/semver
node_modules/parse-semver/node_modules/semver
@vscode/vsce *
Depends on vulnerable versions of parse-semver
Depends on vulnerable versions of semver
node_modules/@vscode/vsce
parse-semver *
Depends on vulnerable versions of semver
node_modules/parse-semver

3 moderate severity vulnerabilities

[joaomoreno]

Yup, we're trying to solve it here: npm/node-semver#564 (comment)