Security issues with prism and markdown-to-jsx dependencies in @uifabric/example-app-base

[christiango]

We now have 2 component governance alerts related to security issues with the dependencies of @uifabric/example-app-base:

These issues include:

• Prism 1.17.1 - pulled in via refractor v 2.10.1, which is a dependency of react-syntax-highlighter v10.3.5. Updating to react-syntax-highlighter 13.3.1 addresses this issue. Advisory
• markdown-to-jsx 6.6.1. Updating to 6.11.4 or later addresses this. Advisory

[khmakoto]

@christiango I have a PR out that updates the markdown-to-jsx package version. Regarding the react-syntax-highlighter package, we've chosen not to upgrad
e it since it would lead to duplicated package versions due to the fact that it is also pulled from @storybook/components. We've chosen to do this given that we don't actively use prism which is the package that is triggering the vulnerability.

[christiango]

Thanks for the update!

[msft-github-bot]

🎉This issue was addressed in #14543, which has now been successfully released as @uifabric/[email protected].:tada:

Handy links:

• Release Notes
• Official NPM Release