Not safe package used by Koa 1.4.0
Hi all,

I wonder if we can have a patch update for Koa 1.4.0 to update the version of a dependency called `fresh`, marked as not safe by `nodesecurity`. The package already have a patched version `>= 0.5.2`.
Details on their website: https://nodesecurity.io/advisories/526

If someone instruct me I could open a PR as well.

Thanks!