Security Vulnerabilities Detected in package-lock.json (npm) via Trivy Scan

I don't think this needs to be marked as critical, since these packages are not part of the distributed Drupal module; they are internal build tools only. Setting priority to "Normal."

Reviewing the use of the Gulp build process in this module and the resulting output, I conclude that it does so little that it is more of a liability to keep the build process in the codebase than it is an asset: there is a a fair amount of boilerplate code for SCSS that doesn't exist, and the JS is only very slightly modified. I propose that we work directly from the relatively small JS file in /assets.

If others in the community feel strongly that the build process should continue to be used, it can be reverted -- I'm not strictly opposed to that, but I will proceed to do the removal here in the absence of other strong opinions. Thanks!