@react-email/code-block depends on vulnerable version of prismjs

[FabianFrank]

Describe the Bug

@react-email/code-block depends on vulnerable version of prismjs

See GHSA-x7hr-w5r2-h6wg for vulnerability description.

Unfortunately as of 3/4/2025 https://github.com/PrismJS/prism appears abandoned and has not had a commit in 3 years, so switching dependencies or making @react-email/code-block optional for people that don't need it might help.

Which package is affected (leave empty if unsure)

No response

Link to the code that reproduces this issue

react-email/packages/code-block/package.json

Line 50 in 8dfb96a

"prismjs": "1.29.0"

To Reproduce

Install @react-email/components as described in the docs and check package-lock.json or node_modules for installed dependencies.

Expected Behavior

@react-email/components should not depend on a vulnerable dependency.

What's your node version? (if relevant)

No response

[daveycodez]

This is showing up in my package now as well. Hope to have this patched asap.

https://github.com/daveyplate/better-auth-ui/security/dependabot/7

[robbertkl]

There's a new release 1.30.0 now, so this can be updated. I see there are already automated PRs #1948 and #1949.

[golddydev]

There's a new release 1.30.0 now, so this can be updated. I see there are already automated PRs #1948 and #1949.

When this PR is going to merged.
#1948 is failed

[albertocubeddu]

+1

[Stefanyshyn]

When will you publish these changes? They are critical to me.

[josh-respectx]

Looks like the changes to update prismjs to 1.30.0 have been merged and are included in the latest react-email release (v4.0.3), but it seems that the @react-email/code-block package hasn't been published to npm with that update yet — it's still showing [email protected] as a dependency there.

Just flagging in case this was missed during the release process. Tagging @gabrielmfern here since I saw you merged the changes — really appreciate all the work you’re doing on this project 🙌

[gabrielmfern]

This has been fixed in @react-email/code-block 0.0.12/@react-email/code-block 0.0.12 and in future versions we'll have it unpinned to avoid these kind of situations.