The vulnerabilities are false positives and React doesn't think those
are worth fixing to make `npm audit` be quiet. We can at least make them
go away for `npm audit --production`, which is the official advice:
https://github.com/facebook/create-react-app/issues/11174.