GitHub pages: Why is there a warning for the contents of the package-lock.json file?

Question

GitHub

Good afternoon!

Mistake:

Dependabot alerts surface known security vulnerabilities in some dependency manifest files. Dependabot security updates automatically keep your application up-to-date by updating dependencies in response to these alerts. Dependabot version updates can also help keep dependencies updated.

Writes about a security vulnerability.

He doesn't like modules:
- trim-newlines
- normalize-url
- xmldom
- lodash.template

What to do with it, update somehow? Remove package-lock? - Because, I don't understand why the installed module is safe, but a couple of package-lock entries about this module are not... Or to ignore the entire file?
Does anyone have information about this vulnerability, and what can you advise?

Answer 1

Remove package-lock?

Remove package-lock and update packages to latest versions.