Fix dependabot vulnerabilities

This adds some forced resolutions to ensure that vulnerable versions
of packages are not installed.

node_modules/normalize-url/package.json

@@ -1,16 +1,19 @@
 {
   "name": "normalize-url",
-  "version": "4.5.0",
+  "version": "7.0.0",
   "description": "Normalize a URL",
   "license": "MIT",
   "repository": "sindresorhus/normalize-url",
+  "funding": "https://github.com/sponsors/sindresorhus",
   "author": {
     "name": "Sindre Sorhus",
     "email": "sindresorhus@gmail.com",
-    "url": "sindresorhus.com"
+    "url": "https://sindresorhus.com"
   },
+  "type": "module",
+  "exports": "./index.js",
   "engines": {
-    "node": ">=8"
+    "node": ">=12.20"
   },
   "scripts": {
     "test": "xo && nyc ava && tsd"
@@ -35,10 +38,15 @@
     "canonical"
   ],
   "devDependencies": {
-    "ava": "^2.4.0",
-    "coveralls": "^3.0.6",
-    "nyc": "^14.1.1",
-    "tsd": "^0.8.0",
-    "xo": "^0.24.0"
+    "ava": "^3.15.0",
+    "nyc": "^15.1.0",
+    "tsd": "^0.17.0",
+    "xo": "^0.41.0"
+  },
+  "nyc": {
+    "reporter": [
+      "text",
+      "lcov"
+    ]
   }
 }