Upgrade to semver v7

[beanow-at-crabnebula]

Semver disclosed this vulnerability: GHSA-c2qf-rxjj-qqgw

And there are no plans to backport the fix to v5/v6. npm/node-semver#576
This plugin is one of my transient dependencies depending on v6.

$ pnpm why semver@^6

devDependencies:
eslint-config-standard-with-typescript 34.0.1
├─┬ eslint-config-standard 17.0.0
│ └─┬ eslint-plugin-import 2.27.5 peer
│   └── semver 6.3.0
└─┬ eslint-plugin-import 2.27.5 peer
  └── semver 6.3.0

While it seems some community members offer to backport the fix, evidently the maintainers are reluctant to support older versions, given v7 was released in 2019. For future sanity of this plugin I'd encourage using the latest major version 😆

[ljharb]

Like most CVEs, it's a false positive. We're not using new Range nor are we doing anything that wouldn't be a self-attack (ie, not an attack).

We can't ever bump the semver version because v7 drops support for engines we support, so unless the fix is backported to v6, it'll just have to remain a false positive.

Duplicate of #2803. Duplicate of #2804. Duplicate of #2805. Duplicate of #2806. Duplicate of #2807.