run `npm audit fix` to fix them, or `npm audit` for details