XSS security issue in Markdown component

[DanielBaird]

npm reports a security issue with the Markdown component.

https://npmjs.com/advisories/1219

This parallels issue 306 in the markdown-to-jsx library. When they fix theirs, we can fix ours.

Expected Behavior

npm audit should report no security issues with Grommet.

Actual Behavior

$ npm audit

                       === npm audit security report ===

┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High          │ Cross-Site Scripting                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ markdown-to-jsx                                              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ No patch available                                           │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @jcu/webapp                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @jcu/webapp > grommet > markdown-to-jsx                      │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1219                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[DanielBaird]

Markdown-to-jsx released 6.11.4 that probably fixes the issue; they're not sure what it will take to convince NPM of that.

I guess grommet should hold off and see if there's another version soon that is NPM-approved

https://github.com/probablyup/markdown-to-jsx/releases/tag/6.11.4

[ShimiSun]

@shovelmn12 FYI.

[rwhogg]

quantizor/markdown-to-jsx#306 has been closed now and npm has marked v6.11.4 as fixing the issue