Storybook: Denial of Service and XSS vulnerabilities reported by Snyk

[dpouliot]

✗ Denial of Service [Medium Severity][https://snyk.io/vuln/SNYK-JS-NODEFETCH-674311] in [email protected]
introduced by @storybook/[email protected] > @storybook/[email protected] > [email protected] and 2 other path(s)
This issue was fixed in versions: 2.6.1, 3.0.0-beta.9
✗ Cross-site Scripting (XSS) [High Severity][https://snyk.io/vuln/SNYK-JS-PRISMJS-597628] in [email protected]
introduced by @storybook/[email protected] > @storybook/[email protected] > [email protected] > [email protected] > [email protected] and 9 other path(s)
This issue was fixed in versions: 1.21.0

[KSJake]

react-syntax-highlighter should be upgraded to at least 13.3.1. I assume this hasn't been done yet because of the breaking changes introduced in v13.0.0.

[shilman]

react-syntax-highlighter is 13.5.0 in 6.1

[tylercraft]

Doesn't appear that the addons have been updated, for example:
https://github.com/storybookjs/storybook/blob/master/addons/storysource/package.json

[shilman]

6.1 is the next branch:

https://github.com/storybookjs/storybook/blob/next/addons/storysource/package.json