Webpack Project is sitting on a vulnerability, avoid it at all costs

Problem with Webpack is that they are allowing such a long dependency chain for micromatch when a simple JavaScript /regex/ expression could do the trick. Their blatant refusal to remove that dependency (as seen in the github link) quite clearly indicates their willingness to perpetuate this dependency problem.