Hi @jcarmona, our own tooling has also picked up on these ‘vulnerable’ NPM packages. The vast majority relate to build/development tooling. For the couple which are transitive dependencies of Discourse’s client-side JS app, we’re satisfied that the vulnerabilities are not exploitable.
That said, we are always working to upgrade our dependencies, so we do hope to upgrade them all in the not-too-distant future.