Default theme includes jquery 1.11.0, which has the XSS security issue https://nvd.nist.gov/vuln/detail/cve-2020-11022 as fixed in 3.5.0 (see https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/). If you check codox doc output into your repo, github dependabot will complain at you about this.