jQuery < v3.5.0 - Cross-Site Scripting ('XSS') Vulnerability (CVE-2020-23064)

[diversemix]

This package appears to statically embed jquery, which means there is no fix by trying to pin a higher version in your package.json -- This approach means any application that uses it is subject to the above CVE

[jrobinso]

Noted. We have plans to eliminate jQuery entirely.