Fix dependabot issues

node_modules/pupa/index.js

@@ -10,7 +10,8 @@ module.exports = (template, data) => {
 		throw new TypeError(`Expected an \`object\` or \`Array\` in the second argument, got \`${typeof data}\``);
 	}
 
-	const doubleBraceRegex = /{{(.*?)}}/g;
+	// The regex tries to match either a number inside `{{ }}` or a valid JS identifier or key path.
+	const doubleBraceRegex = /{{(\d+|[a-z$_][a-z\d$_]*?(?:\.[a-z\d$_]*?)*?)}}/gi;
 
 	if (doubleBraceRegex.test(template)) {
 		template = template.replace(doubleBraceRegex, (_, key) => {
@@ -24,7 +25,7 @@ module.exports = (template, data) => {
 		});
 	}
 
-	const braceRegex = /{(.*?)}/g;
+	const braceRegex = /{(\d+|[a-z$_][a-z\d$_]*?(?:\.[a-z\d$_]*?)*?)}/gi;
 
 	return template.replace(braceRegex, (_, key) => {
 		let result = data;

node_modules/pupa/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pupa",
-  "version": "2.0.1",
+  "version": "2.1.1",
   "description": "Simple micro templating",
   "license": "MIT",
   "repository": "sindresorhus/pupa",