Hey, did you find any resolution to this? I am facing a similar issue, particularly with the semver vulnerability. I have tried all kinds of things. My concern is that I possibly have to wait for various package owners to update their packages. I usually can resolve this by changing version numbers, but this time I am in a deadlock.