Bump d3-color #1728
Comments
|
Hi @foreseeti-adam, thank you for reporting this issue, as it's a major version change, we would have to investigate a little bit before migrating. If the only change is the adoption of modules, shouldn't be an issue though as we already use ESM. |
|
This issue has been automatically marked as stale. If this issue is still affecting you, please leave any comment (for example, "bump"), and we'll keep it open. We are sorry that we haven't been able to prioritize it yet. If you have any new additional information, please include it with your comment! |
|
Bump, d3-color@2.0.0 has a Regular Express Denial of Service vulnerability via the rgb() and hrc() functions since August 2020. Popular composition analysis tools are thus flagging nivo as introducing a vulnerable 3rd party component. |
|
This issue has been automatically marked as stale. If this issue is still affecting you, please leave any comment (for example, "bump"), and we'll keep it open. We are sorry that we haven't been able to prioritize it yet. If you have any new additional information, please include it with your comment! |
|
Closing this issue after a prolonged period of inactivity. If this issue is still present in the latest release, please create a new issue with up-to-date information. Thank you! |
|
The d3-color package is still being flagged by security tools. Can this be upgraded to 3.1.0 in the next release? |
|
Hey guys, any news on this? |
|
still being flagged like vulnerable to ReDoS and no fix available |
|
@plouc any fix for this? |
|
|
The vulnerability still exists for me because two of nivo's dependencies: Anybody still getting the flagged after updating to Update: Just saw this issue that was closed: #2348 , but it doesn't seem included in the latest release? |
|
This seems still be issue? It seems that Subsequently, |
|
Unfortunately, I confirm what @RikuRuokonen is saying. After upgrading to latest release 0.83, I still have this issue. This issue should be re-opened please @plouc 🙏 |
|
The same for me d3-color <3.1.0 And, now I use |
|
This should be fixed in |
|
Sunburst is still showing vulnerability, but maybe it needs a new issue for tracking? |
@plouc Updating to It looks like |
|
@jvu1 +1 on this. |
|
|
|
I think this is still an active issue, what I did to solve it was to use package.json {
"resolutions": {
"d3-color": "^3.1.0"
},
}npm ls d3-color
npm ERR! code ELSPROBLEMS
npm ERR! invalid: d3-color@3.1.0 /Users/reacted/company/project/node_modules/d3-color
company-proejct@0.1.0 /Users/redacted/company/project
├─┬ @nivo/core@0.84.0
│ ├── d3-color@3.1.0
│ ├─┬ d3-interpolate@3.0.1
│ │ └── d3-color@3.1.0 deduped
│ ├─┬ d3-scale-chromatic@3.0.0
│ │ └── d3-color@3.1.0 deduped
│ └─┬ d3-scale@3.3.0
│ └─┬ d3-interpolate@2.0.1
│ └── d3-color@3.1.0 deduped invalid: "1 - 2" from node_modules/d3-scale/node_modules/d3-interpolate
└─┬ @nivo/line@0.84.0
└─┬ @nivo/colors@0.84.0
├── d3-color@3.1.0 deduped
└─┬ d3-scale-chromatic@2.0.0
├── d3-color@3.1.0 deduped invalid: "1 - 2" from node_modules/d3-scale/node_modules/d3-interpolate, "1 - 2" from node_modules/@nivo/colors/node_modules/d3-scale-chromatic
└─┬ d3-interpolate@2.0.1
└── d3-color@3.1.0 deduped invalid: "1 - 2" from node_modules/d3-scale/node_modules/d3-interpolate, "1 - 2" from node_modules/@nivo/colors/node_modules/d3-scale-chromatic, "1 - 2" from node_modules/@nivo/colors/node_modules/d3-interpolate
npm ERR! A complete log of this run can be found in: /Users/redacted/.npm/_logs/2024-01-19T06_27_42_820Z-debug-0.logAnd well, just hope it works. |
Hi,
d3-color version<3.0.0 that is used in some of your packages is vulnerable to ReDoS, hence it would be a good idea to bump this (if possible) in your next release.
Thank you for providing a great visualization tool!
The text was updated successfully, but these errors were encountered: