from @pombredanne

We could have some vulnerable dependencies and it would be nice to review if we can
update our dependencies.

For example currently on https://github.com/nexB/scancode-workbench/tree/feature/unittests
if we run npm install we have

28 vulnerabilities (5 moderate, 22 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

There are 3 sources where we can check for potential vulnerabilities:

1, We should update these packages that show up on npm install
2. We also should look at dependabot notifications for the same thing.
3. And another thing could be to run SCIO pipelines to get purls and look up vulnerabilities for workbench (and maybe compare them across npm and dependabot :P )

This would be nice to have before the stable release.
Other non-vulnerable dependency upgrades should be also something we can look at potentially,
these could have useful updates and upgrades too.