そうそう、momentの脆弱性には対応できたっぽいです
https://github.com/zunda/covid-vue-chart/security/dependabot/24
$ yarn why moment
yarn why v1.22.15
[1/4] Why do we have the module "moment"...?
[2/4] Initialising dependency graph...
[3/4] Finding dependency...
[4/4] Calculating file sizes...
=> Found "moment@2.29.2"
info Reasons this module exists
- "moment-timezone" depends on it
- Hoisted from "moment-timezone#moment"
- Hoisted from "chart.js#moment"
- Hoisted from "vue-chartjs#@types#chart.js#moment"
info Disk size without dependencies: "5.15MB"
info Disk size with unique dependencies: "5.15MB"
info Disk size with transitive dependencies: "5.15MB"
info Number of shared dependencies: 0
Done in 0.82s.