I am trying to setup a Qwik project without vulnerabilities:

$ npm audit

npm audit report

esbuild <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server
and read the response - GHSA-67mh-4wv8-2f99
fix available via npm audit fix --force
Will install [email protected], which is outside the stated dependency range
node_modules/esbuild
vite 0.11.0 - 6.1.5
Depends on vulnerable versions of esbuild
node_modules/vite

2 moderate severity vulnerabilities

To address all issues, run:
npm audit fix --force

$ npm audit fix --force

npm warn using --force Recommended protections disabled.
npm warn audit Updating vite to 5.4.18, which is outside your stated dependency range.

changed 1 package, and audited 392 packages in 4s

219 packages are looking for funding
run npm fund for details

npm audit report

esbuild <=0.24.2
Severity: moderate
esbuild enables any website to send any requests to the development server
and read the response - GHSA-67mh-4wv8-2f99
fix available via npm audit fix --force
Will install [email protected], which is a breaking change
node_modules/esbuild
vite 0.11.0 - 6.1.5
Depends on vulnerable versions of esbuild
node_modules/vite
@builder.io/qwik >=1.2.16
Depends on vulnerable versions of vite
node_modules/@builder.io/qwik
@builder.io/qwik-city >=1.2.16
Depends on vulnerable versions of vite
node_modules/@builder.io/qwik-city

4 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
npm audit fix --force

$ npm audit fix --force

npm warn using --force Recommended protections disabled.
npm warn audit Updating vite to 6.2.6, which is a SemVer major change.
npm warn audit Updating @builder.io/qwik-city to 1.2.15, which is a SemVer
major change.
npm warn audit Updating @builder.io/qwik to 1.2.15, which is a SemVer major change.

added 59 packages, removed 15 packages, changed 73 packages, and audited 436 packages in 20s

222 packages are looking for funding
run npm fund for details

npm audit report

@builder.io/qwik <1.7.3
Severity: moderate
Qwik has a potential mXSS vulnerability due to improper HTML escaping - GHSA-2rwj-7xq8-4gx4
fix available via npm audit fix --force
Will install @builder.io/[email protected], which is outside the stated dependency range
node_modules/@builder.io/qwik

1 moderate severity vulnerability

To address all issues, run:
npm audit fix --force

$ npm audit fix --force

npm warn using --force Recommended protections disabled.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @builder.io/[email protected]
npm warn Found: [email protected]
npm warn node_modules/vite
npm warn dev vite@"^6.2.6" from the root project
npm warn 1 more (vite-tsconfig-paths)
npm warn
npm warn Could not resolve dependency:
npm warn peer vite@"^5" from @builder.io/[email protected]
npm warn node_modules/@builder.io/qwik
npm warn dev @builder.io/qwik@"^1.2.15" from the root project
npm warn
npm warn Conflicting peer dependency: [email protected]
npm warn node_modules/vite
npm warn peer vite@"^5" from @builder.io/[email protected]
npm warn node_modules/@builder.io/qwik
npm warn dev @builder.io/qwik@"^1.2.15" from the root project

changed 1 package, and audited 436 packages in 7s

222 packages are looking for funding
run npm fund for details

found 0 vulnerabilities

What is a recommended setup?