The sonatype finding says this:
sonatype-2019-0115
The application is vulnerable by using this component. Certain versions of jQuery (for example 3.4.1 present in NuGet downloads), even if fixed, may continue to report this vulnerability because of the bundled jquery-...vsdoc.js variant still containing vulnerable code. In such cases, you are vulnerable only if the ...-vsdoc.js file is being used directly in your production application.
This issue was resolved with jQuery 3.4.1. How can I tell if a "bundled -vsdoc.js" file is being used? There are no references to it anywhere in the project, I don't see it included in the nuget package, and the only references I can find to the file on google have to do with really old versions of jQuery.
Follow up question, how does someone get into a vulnerable state when using the latest version of jQuery? Basically I'm trying to figure out how to definitively prove that this vulnerability does not affect my program.