I checked 26 popular Node.js starters. 18 ship a high-severity vulnerability that npm update can't fix

What happens to the dependencies of a boilerplate after you clone it, measured on 26 public Express, Koa, Nest and MERN starters.