AssetManager copies entire bower-asset package (including executable test/script files) to web/assets

Description

AssetManager copies entire bower-asset package (including executable test/script files) to web/assets

'assetManager' => [
    'forceCopy' => true,
    'appendTimestamp' => false,
    'linkAssets' => false,
]

and after including the pjax component in a view - when a client accesses the site, the following files and subfolders appear in web/assets/<random_name>/ directory from vendor/bower-assets/:

• /script
• /test
• /vendor
• CHANGELOG.md
• CONTRIBUTING.md
• Gemfile
• Gemfile.lock
• jquery.pjax.js
• LICENSE
• package.json
• README.md

The contents of all these files and subfolders can be viewed (if directory listing is not disabled at the web server level).

What particularly concerns me are three "executable" files in the "/script" folder:

• bootstrap
• server
• test

I'm not sure if this poses a security threat to the site, but it seems to me that their presence in web/assets is clearly unnecessary.

composer.lock:
...
{
            "name": "bower-asset/yii2-pjax",
            "version": "2.0.9",
            "source": {
                "type": "git",
                "url": "https://github.com/yiisoft/jquery-pjax.git",
                "reference": "452b56b7124326487fd0d3be6b205fcaa66598a0"
            },
 },
...

Package version

2.0.54

PHP version

8.3.30