This would have been completely avoided if you were using bun dependency vector locking in Nix.

That way instead of getting the vulnerabilities now, you get them later! The joys of computing!