How to solve the problem with a vulnerable transitive dependency used by several libraries if updating React is not possible now?