jest has a dependency on minimatch which triggers npm audit even after clean npm lock. https://nodejs.org/api/test.html Let's reduce the number of dependencies.