See GHSA-8g2p-5pqh-5jmc

Obviously app consumers can perform the update themselves since we just set a lower bound, but by updating we can be sure that we won't bring a bad version in transitively.