If they're vendoring the dependency anyway, that wouldn't matter much if they're not using features that were added since 2021.

The last release of jsonata was mid 2025, and there hasn't been new features since the last 2022 release until the latest, so it's likely those other ports are fine.