Even though contentful says it adds a dependency on axios at some version, it actually inlines the dependency into the browser, causing potentially unsafe versions to end up in your final built assets ...
One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': mailgun.amd.js (pkg:javascript/[email protected]): CVE ...