There are two vulnerabilities in the package-lock. And the lockfileVersion is 2, after npm 8, the lockfileVersion should be 3. Upgrade to typescript 5.6 will break the AzureAppConfigurationImpl because the ReadonlyMap API changed.