Repository navigation
d3-interpolate depends on vulnerable d3-color #6333
Description
Following the vulnerability revealed in https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592
plotly.js uses d3-interpolate 1.4.1 which still depends on vulnerable d3-color 1.4.1
Given plotly currenlty depends on d3-color 3.8 (see https://github.com/plotly/d3/blob/master/package.js) which is not affected, could we update this dependency to 3.0.1?
Activity
whittet commentedon Oct 3, 2022
Impacts angular 14
krisstern commentedon Oct 7, 2022
The vulnerability in
d3-colorwas patched for version >=3.1.0.peratik commentedon Oct 11, 2022
"plotly.js": "^2.15.1",Hi, Same here, Please advice.
archmoj commentedon Oct 11, 2022
The
d3-interpolatemodule is an ES module.To handle that we need to change our build processes quite a bit.
This may include migrating from
browserifytowebpack..AND. we are currently investigating that.
saumzzz commentedon Oct 20, 2022
Hey guys any update on this? Any temporary workarounds?
raulmarindev commentedon Nov 2, 2022
They started with the migration to
webpack. #6355whittet commentedon Jan 3, 2023
Looks like now that webpack is merged to master the d3-interpolate package version can be updated to 3.0.1. I asked for same in a comment on this PR: #6344
flying-sheep commentedon Jan 12, 2023
I did that in #6427, but I don’t know how to fix the build error.
If you want this fixed, feel free to help fix that PR.
krisstern commentedon Jan 16, 2023
I found out if I use
yarnI can add the following topackage.jsonand then runyarn install(may need to delete the entirenode_modulesbeforehand) to get rid of the vulnerability after upgradingplotly.jsto version 2.17.1:whittet commentedon Jan 16, 2023
@krisstern Thanks! I don't have yarn, so my alternative is to upgrade npm to ^8.3.0, upgrade node to ^16.13.0 (due to Angular 14.2) and add the following to package.json:
"overrides": {
"d3-color": "3.1.0",
}
I'm sure a few other overrides could work, but this was the first one I found.
Although, this completely rewrote the angular site's package-lock.json.
archmoj commentedon Feb 1, 2023
Addressed in #6463.