Any reason why debug is still using ms 0.7.2 version?

"dependencies": {
"ms": "0.7.2"

node security scanner is complaining that this dependency is vulnerable to CVE-2015-8315, https://nodesecurity.io/advisories/46 although its a false- positive detection since fix is implemented beginning at 0.7.1 and up.

Thanks!
Ron