(security alert) morgan needs to be updated

[fursich]

Hi, first of all thanks really a lot for maintaining the package!

security alert

Just noticed github has been giving an alert for potential vulnerability on morgan, one of its dependencies.

(datailed report here)
https://nvd.nist.gov/vuln/detail/CVE-2019-5413

Understanding that this package has been suffering from low maintainer resources, I thought it would be useful to raise alert as it looks some sort of vulnerability, which (possibly) could be dealt relatively easily by updating the dependencies.

additional info

I'm not very knowledgeable about the internal of this package, but after a quick look-over it looks like the version is locked here, which currently is preventing us from upgrading morgan upto its safe version.
Hope it helps!