Lexical/react lib showing vulnerability for dependency lib prism

[dhavalptl]

found lexical/react has dependency with prism and it has vulnerability sonatype 7.5 severity and CVE 6.9 severity. I think there is no update from prism long time. Any plan to fix or update lib?

[arbtin]

Prismjs just dropped a new 1.30

[davejhilton]

Yeah, it would be great to get a new release that includes the updated prismjs 1.30

[etrepum]

It's not a relevant security advisory unless you are explicitly using the prism-autoloader plug-in (lexical does not use this) and also have user-generated HTML in your page (e.g. that can arbitrarily choose to set id="currentScript", lexical does not do that either)