word-wrap version change not available in NPM but available in Github | word-wrap vulnerable to Regular Expression Denial of Service

The following link shows older version for word-wrap i.e version "word-wrap": "^1.0.3"


The same package has been bumped in the latest master branch of the
[cz-conventional-changelog](https://github.com/commitizen/cz-conventional-changelog)

The older version has been flagged to have the following issue:

word-wrap vulnerable to Regular Expression Denial of Service

Reference:

https://github.com/advisories/GHSA-j8xg-fqg3-53r7

Compare the published npm package with the latest master branch of cz-conventional-changelog and inspect where the word-wrap dependency is declared. Confirm whether the vulnerable ^1.0.3 version is still published or used, then verify that the available update removes the referenced Regular Expression Denial of Service advisory.

Written by the indexing model from the issue text.