transitive dependency 'minimist' needs to be updated by rebuilding

This is not AFAIK an actual security vulnerability, but this package bundles a package that has a security vulnerability. My company tries to maintain a baseline of 0 'critical' vulnerabilities as labelled by yarn audit, but we have installed something that includes the json5 package and has flagged this for us. https://github.com/advisories/GHSA-xvch-5gv4-984h

From reading the package-lock.json file, I believe that it is sitting on minimist 1.2.5 only because that was the latest version at the time of build: the packages that include it all use semver syntax like ^1.2.2, so simply re-running npm install or equivalent should bring in minimist 1.2.6 with the fix.