Seems three.js hasn't been updated from upstream for a long time... Maybe 3-5 years?
No idea what version we're apparently using - adding a foreign-resources.yaml would be appreciated too; T330430: Proliferate usage of foreign-resources.yaml in WMF deployed and MW bundled skins and extensions
Would help fix one minor case of T254646: Reconsidering how we name things (a mention of whitelist in a comment that doesn't seem to be upstream anymore)
Last update was in 7f1e2a4e583f53c5de16144c3a66ca59aa3e973a (Nov 2017).
https://threejs.org/ links to https://github.com/mrdoob/three.js/ . No idea if that's still the codebase or if it has just diverged so much.
https://www.mediawiki.org/wiki/Wikimedia_Product/Component_responsibility says "Non-security patches not reviewed." so WMF decided to be stuck.
Helpfully, it says
three.js: from 75 to 88
https://github.com/mrdoob/three.js/releases/tag/r156 is from "3 days ago"; September 5th
https://github.com/mrdoob/three.js/compare/r88...r156 is over 5000 commits
https://www.npmjs.com/package/three?activeTab=versions uses completely different version numbers...