There was accidentally a second layer of callback here. I'm not sure why
it worked. I think the lambda being returned was being used as the
cleanup function?
The vulnerabilities are false positives and React doesn't think those
are worth fixing to make `npm audit` be quiet. We can at least make them
go away for `npm audit --production`, which is the official advice:
https://github.com/facebook/create-react-app/issues/11174.
