Our client recently performed a security scan on their instance of Skosmos, and flagged up (among other things) that the URI.js library version v1.19.0 has a known vulnerability, CVE-2021-3647. This is fixed in v1.19.7, and the latest is v1.19.11. In fact, most of the changes in URI.js between versions 1.19.0 and 1.19.11 are flagged as security fixes.

As a workaround for now, in our Docker builds we will be using a modified composer.json file with URI.js version set to 1.19.11. Would this version update be feasible in the baseline Skosmos repo?