[Security] Bump xterm from 3.3.0 to 4.4.0

[dependabot-preview]

Bumps xterm from 3.3.0 to 4.4.0. This update includes a security fix.

Vulnerabilities fixed

Sourced from The GitHub Security Advisory Database.

Low severity vulnerability that affects xterm A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters, aka "Xterm Remote Code Execution Vulnerability." This affects xterm.js.

Affected versions: < 3.8.1

Release notes

Sourced from xterm's releases.

4.4.0

🚀 Features

• A new addon is available that serializes the buffer as a string, allowing restoring the majority of the state to a new terminal by calling Terminal.write(serializedState). See the xterm-addon-serialize section below for more info.
• A new addon to enable unicode 11 support, which can fix many emoji-width related bugs on modern operating systems. See the xterm-addon-unicode11 section below for more info.
• Support alt-clicking in multi-line prompts in the normal buffer (#2670) via @kumaran-14

📦 API

• Support for some window manipulation/reporting sequences (#2393) via @jerch. These must be enabled explicitly via the new windowOptions option as they have security implications.
• Allow the thickness of the bar cursor to be configured (#2590) via @npezza93

  new Terminal({
    cursorStyle: 'bar',
    cursorBarWidth: 3
  });

• The parser API is now stable (#2689) via @Tyriar

🐞 Bug fixes

• Speed up double disposing an object (#2616) via @sdegutis
• Implement hidden attribute rendering in DOM renderer (#2625) via @Tyriar
• Fix canvas selection supporting #rrggbbaa color format (#2629) via @ivanwonder
• Improve handling of full width characters in buffer writes (#2644) via @jerch
• Flag lines as being wrapped after a CUP occurs at the end of a line in windowsMode (#2667) via @Tyriar
• Properly separate DOM renderer cursor animations for each terminal to avoid conflicts when multiple terminals are visible with different themes (#2676) via @jeffbaier
• Fix various characters in the DEC graphics charset (#2679) via @jerch
• Remove ; and : from the default wordSeparator option so more URLs are selected fully with double click (#2680) via @Tyriar
• Fix DOM renderer not rendering cursor correctly immediately after changing cursorBlink or cursorStyle (#2684) via @Tyriar
• Handle links safely by removing opener from window (#2688) via @Tyriar

📝 Documentation and internal improvements

• Implement tooling to document and extract the supported VT features of xterm.js (#2386) via @jerch
• Update node-pty to v0.9 (#2621) via @jerch
• Reducing internal circular dependencies (#2637, #2640) via @Tyriar
• Improve the structure of the color helper library (#2653) via @Tyriar
• Fix failing Linux unit tests not failing job in CI (#2682) via @Tyriar
• Remove old unused options from codebase and API (#2685) via @Tyriar

🛑 Breaking changes

• APIs starting with add in the experimental parser API have been removed in favor of register as it enters stable status (#2651) via @Tyriar

⚠️ Deprecations

• addMarker is now deprecated, move over to registerMarker which is functionally equivalent (#2651) via @Tyriar

🎉 New real-world use cases

... (truncated)

Commits

• a840db3 Merge pull request #2692 from xtermjs/Tyriar-patch-1
• dc19d7c v4.4.0
• 4d0fc16 Merge pull request #2691 from Tyriar/bump2
• b13c3be Bump serialize and unciode11 addon versions to trigger publish
• a3a222c Merge pull request #2690 from Tyriar/version_bump_publish
• 1d7cfcd Bump webgl and attach versions
• 2c05e72 Publish serialize and unicode11 addons automatically
• 22acf1e Merge pull request #2618 from xtermjs/feat/serialize-addon
• 9c8deb1 Revert "Remove getNullCell"
• 9b9cb5c Merge branch 'master' into feat/serialize-addon
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by tyriar, a new releaser for xterm since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
• @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
• @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
• @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
• @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
• @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

• Update frequency (including time of day and day of week)
• Pull request limits (per update run and/or open at any time)
• Out-of-range updates (receive only lockfile updates, if desired)
• Security updates (receive only security updates, if desired)

[dependabot-preview]

Superseded by #17.