In my package.json I have listed gulp as one of my dependencies.

{
    "name": "myproject",
    "devDependencies": {
        "gulp": "^4.0.2"
        // other stuff
    }
}

When I run npm i I get a message there are moderate security vulnerabilities. So I do npm audit and I get this

                       === npm audit security report ===                        


                                 Manual Review                                  
             Some vulnerabilities require your attention to resolve             
                                                                                
          Visit https://go.npm.me/audit-guide for additional guidance           


  Moderate        Regular expression denial of service                          

  Package         glob-parent                                                   

  Patched in      >=5.1.2                                                       

  Dependency of   gulp [dev]                                                    

  Path            gulp > glob-watcher > chokidar > glob-parent

  More info       https://npmjs.com/advisories/1751


  Moderate        Regular expression denial of service

  Package         glob-parent

  Patched in      >=5.1.2

  Dependency of   gulp [dev]

  Path            gulp > vinyl-fs > glob-stream > glob-parent

  More info       https://npmjs.com/advisories/1751

found 2 moderate severity vulnerabilities in 751 scanned packages
  2 vulnerabilities require manual review. See the full report for details.

So then I thought it was all a matter of changing the version of gulp to the highest version where it is (probably) patched. But it seems that this is already the highest version, so what do I do about the vulnerability?