This is a transitive dep of unplugin-vue2-script-setup and recent version does play well with Jest. Only used when running unit test, the security issue has no impact in our situation. We are progressively moving away from Vue 2 so this lib will be dropped as well at some point, it is probably not needed to waste more time on it.