Giter Club home page Giter Club logo

Comments (5)

zC4sTr0 avatar zC4sTr0 commented on June 4, 2024 1

I fixed this issue on our project using override's feature of npm:

Reference: npm's package.json Documentation

  "overrides": {
    "d3-color": "^3.1.0"
  }

from nivo.

ItamarShDev avatar ItamarShDev commented on June 4, 2024 1

I fixed this issue on our project using override's feature of npm:

Reference: npm's package.json Documentation

  "overrides": {
    "d3-color": "^3.1.0"
  }

great solution meanwhile. thanks!

from nivo.

brandanking-decently avatar brandanking-decently commented on June 4, 2024

This is still the case, any indication on if this will be fixed?

from nivo.

rhendz avatar rhendz commented on June 4, 2024

I'm getting this as well on v0.84.0:

# npm audit report
d3-color  <3.1.0
Severity: high
d3-color vulnerable to ReDoS - https://github.com/advisories/GHSA-36jr-mh4h-2g58
No fix available
node_modules/@nivo/core/node_modules/d3-scale/node_modules/d3-color
  d3-interpolate  0.1.3 - 2.0.1
  Depends on vulnerable versions of d3-color
  node_modules/@nivo/core/node_modules/d3-scale/node_modules/d3-interpolate
    d3-scale  0.1.5 - 3.3.0
    Depends on vulnerable versions of d3-interpolate
    node_modules/@nivo/core/node_modules/d3-scale
      @nivo/core  *
      Depends on vulnerable versions of @nivo/tooltip
      Depends on vulnerable versions of d3-scale
      node_modules/@nivo/core
        @nivo/tooltip  *
        Depends on vulnerable versions of @nivo/core
        node_modules/@nivo/tooltip

Additionally, it appears [email protected] contains the vulnerable d3-color sub dependency.

# npm list d3-color
└─┬ @nivo/[email protected]
  ├── [email protected]
  ├─┬ [email protected]
  │ └── [email protected] deduped
  ├─┬ [email protected]
  │ └── [email protected] deduped
  └─┬ [email protected]
    └─┬ [email protected]
      └── [email protected]

from nivo.

plouc avatar plouc commented on June 4, 2024

Duplicate of #2470

from nivo.

Related Issues (20)

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.