Hello! I just installed Microbundle in my project, but after I did so (npm i --save-dev microbundle), npm told me that it introduced the following high severity vulnerability:

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Remote Code Execution                                        │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ serialize-javascript                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.1.0                                                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ microbundle [dev]                                            │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ microbundle > rollup-plugin-terser > serialize-javascript    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1548                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

Here are the specific version numbers that got installed:

└─┬ microbundle@0.12.3
  └─┬ rollup-plugin-terser@5.3.0
    └── serialize-javascript@2.1.2 

Is this remote code execution vulnerability something I should be worried about, or does it not apply to Microbundle?

Being that this vulnerability is fixed in serialize-javascript >=3.1.0, it looks like updating rollup-plugin-terser to at least 6.0.0 would update serialize-javascript to a safe version. I tried forking Microbundle, updating rollup-plugin-terser to 7.0.0, crossing my fingers, and running the tests, but unfortunately, the tests failed, so some breaking change must be getting in the way.