title: Is it possible to update dependent libraries bundled inside DoJo source?
body: <p>We have downloaded and used the dojo-release-1.16.4-src.zip and our security scan has reported several issues against it. Some of the problems reported are as below:</p>
  <ol>
  <li>CVE-2015-8857 (High) detected in uglify-js-2.3.6.tgz</li>
  <li>CVE-2015-8861 (Medium) detected in handlebars-1.3.0.tgz</li>
  <li>WS-2020-0044 (High) detected in decompress-0.2.3.tgz
  The above packages and their versions are mentioned in the package-lock.json file. I also checked the latest version of DoJo i.e dojo-release-1.17.2 and even that has identical versions.</li>
  </ol>
  <p>So do we have a DoJo version that bundles the latest versions of these packages?
  Or can we manually build the DoJo using the latest version of packages and will it work? Do we have documented steps to do this?</p>