[Security] Bump morgan from 1.8.2 to 1.9.1 (#301)
[Security] Bump morgan from 1.8.2 to 1.9.1 (#301)

Bumps [morgan](https://github.com/expressjs/morgan) from 1.8.2 to 1.9.1. **This update includes security fixes.**
<details>
<summary>Vulnerabilities fixed</summary>

*Sourced from [The Node Security Working Group](https://github.com/nodejs/security-wg/blob/master/vuln/npm/473.json).*

> **Arbitrary Code Injection**
> Code Injection Vulnerability in morgan Package
> 
> Affected versions: <1.9.1

</details>
<details>
<summary>Release notes</summary>

*Sourced from [morgan's releases](https://github.com/expressjs/morgan/releases).*

> ## 1.9.1
>   * Fix using special characters in format
>   * deps: depd@~1.1.2
>     - perf: remove argument reassignment
> 
> ## 1.9.0
>   * Use `res.headersSent` when available
>   * deps: basic-auth@~2.0.0
>      - Use `safe-buffer` for improved Buffer API
>   * deps: debug@2.6.9
>   * deps: depd@~1.1.1
>     - Remove unnecessary `Buffer` loading
</details>
<details>
<summary>Changelog</summary>

*Sourced from [morgan's changelog](https://github.com/expressjs/morgan/blob/master/HISTORY.md).*

> 1.9.1 / 2018-09-10
> ==================
> 
>   * Fix using special characters in format
>   * deps: depd@~1.1.2
>     - perf: remove argument reassignment
> 
> 1.9.0 / 2017-09-26
> ==================
> 
>   * Use `res.headersSent` when available
>   * deps: basic-auth@~2.0.0
>      - Use `safe-buffer` for improved Buffer API
>   * deps: debug@2.6.9
>   * deps: depd@~1.1.1
>     - Remove unnecessary `Buffer` loading
</details>
<details>
<summary>Commits</summary>

- [`572dd93`](https://github.com/expressjs/morgan/commit/572dd937f26d486babc709228c98fd15dd807408) 1.9.1
- [`e02de38`](https://github.com/expressjs/morgan/commit/e02de384bd27c6131c516e05d6499845a6793707) lint: apply standard 12 style
- [`e329663`](https://github.com/expressjs/morgan/commit/e329663836809de4be557b200a5b983ab8b4e6c2) Fix using special characters in format
- [`eb1968a`](https://github.com/expressjs/morgan/commit/eb1968ac69a3d1ad98bacd06b738e9125630c3d3) tests: use strict equality checks
- [`310b206`](https://github.com/expressjs/morgan/commit/310b2069de0143c958db341141cbc429bc0e2cd2) build: use yaml eslint configuration
- [`5810937`](https://github.com/expressjs/morgan/commit/581093770cc2c323a39fd306034e9e859cb0ffb2) build: Node.js@9.11
- [`f60afd5`](https://github.com/expressjs/morgan/commit/f60afd502f5be3ebc916f10dab84fdb818a1c494) build: Node.js@8.11
- [`5295b0c`](https://github.com/expressjs/morgan/commit/5295b0cff959201aa06186f999d8d48f8f3c8384) build: eslint-plugin-standard@3.1.0
- [`178daaf`](https://github.com/expressjs/morgan/commit/178daaf25c4edebc9daddd5a847d40cd69594705) build: eslint-plugin-promise@3.8.0
- [`7b08641`](https://github.com/expressjs/morgan/commit/7b08641f7d96472bd959b11f07cfaef94f6818ba) build: eslint-plugin-import@2.12.0
- Additional commits viewable in [compare view](https://github.com/expressjs/morgan/compare/1.8.2...1.9.1)
</details>
<br />

[![Dependabot compatibility score](https://api.dependabot.com/badges/compatibility_score?dependency-name=morgan&package-manager=npm_and_yarn&previous-version=1.8.2&new-version=1.9.1)](https://dependabot.com/compatibility-score.html?dependency-name=morgan&package-manager=npm_and_yarn&previous-version=1.8.2&new-version=1.9.1)

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.

---

**Note:** This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking `Bump now` in your [Dependabot dashboard](https://app.dependabot.com).

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot ignore this [patch|minor|major] version` will close this PR and stop Dependabot creating any more for this minor/major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
- `@dependabot use these labels` will set the current labels as the default for future PRs for this repo and language
- `@dependabot use these reviewers` will set the current reviewers as the default for future PRs for this repo and language
- `@dependabot use these assignees` will set the current assignees as the default for future PRs for this repo and language
- `@dependabot use this milestone` will set the current milestone as the default for future PRs for this repo and language
- `@dependabot badge me` will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot [dashboard](https://app.dependabot.com):
- Update frequency (including time of day and day of week)
- Automerge options (never/patch/minor, and dev/runtime dependencies)
- Pull request limits (per update run and/or open at any time)
- Out-of-range updates (receive only lockfile updates, if desired)
- Security updates (receive only security updates, if desired)

Finally, you can contact us by mentioning @dependabot.

</details>
switchfly/ember-cli-mocha,switchfly/ember-cli-mocha,ember-cli/ember-cli-mocha,ember-cli/ember-cli-mocha