There's a vuln in ua-parser-js but that's only used in a command line tool commands/stats.js. There's another one in json5 which is used by babel which is then used by stylelint but I don't need stylelint in this project's modules. It can be installed globally instead since it's only used in my Vim setup.

package.json

@@ -61,8 +61,6 @@
     "rollup-plugin-node-externals": "^2.2.0",
     "rollup-plugin-svelte": "^7.1.0",
     "rollup-plugin-terser": "^7.0.2",
-    "stylelint": "^13.13.1",
-    "stylelint-config-standard": "^22.0.0",
     "svelte": "^3.55.0",
     "terser": "^5.16.1",
     "v8-to-istanbul": "^8.1.1",