Vulnerable version of jquery packaged in cucumber-core

[aikebah]

Describe the bug
An OWASP depenendency-check plugin run against an internal test library surfaced a vulnerable version of jquery is packaged within the cucumber-core library.

To Reproduce

• Run OWASP dependency-check against any version of cucumber-core.
• See it indicating a vulnerable version (3.4.1) of jquery in the analysis results.

Expected behavior
Cucumber-core has no vulnerable libraries included.

Context & Motivation

While I suspect that the given vulnerability (XSS vulnerability in html.preFilter) is not directly applicable to the library I would expect vulnerable javascript libraries to be fixed in a subsequent cucumber release.

Your Environment

• Version used: 5.7.0; validated in github that the current master still uses jquery-3.4.1.min.js

Additional context
See JQuery's release-notes for version 3.5.0 for details on the vulnerability as well as notes on potentially breaking code that depended on the old behaviour:
https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/