switched to more maintained @tmcw/togeojson

Solves few security issues

modules/svg/data.js

@@ -5,7 +5,7 @@ import { text as d3_text } from 'd3-fetch';
 import { select as d3_select } from 'd3-selection';
 
 import stringify from 'fast-json-stable-stringify';
-import toGeoJSON from '@mapbox/togeojson';
+import { gpx, kml } from '@tmcw/togeojson';
 
 import { geoExtent, geoPolygonIntersectsPolygon } from '../geo';
 import { services } from '../services';
@@ -324,10 +324,10 @@ export function svgData(projection, context, dispatch) {
         var gj;
         switch (extension) {
             case '.gpx':
-                gj = toGeoJSON.gpx(xmlToDom(data));
+                gj = gpx(xmlToDom(data));
                 break;
             case '.kml':
-                gj = toGeoJSON.kml(xmlToDom(data));
+                gj = kml(xmlToDom(data));
                 break;
             case '.geojson':
             case '.json':

package.json

@@ -46,8 +46,8 @@
     "@ideditor/location-conflation": "~1.0.2",
     "@mapbox/geojson-area": "^0.2.2",
     "@mapbox/sexagesimal": "1.2.0",
-    "@mapbox/togeojson": "0.16.0",
     "@mapbox/vector-tile": "^1.3.1",
+    "@tmcw/togeojson": "^4.5.0",
     "@turf/bbox-clip": "^6.0.0",
     "abortcontroller-polyfill": "^1.4.0",
     "aes-js": "^3.1.2",