Skip to content

Conversation

@ahmohamed
Copy link

@ahmohamed ahmohamed commented Sep 27, 2021

This PR updates outdated dependencies d3-array, d3-selection and d3-transition as well as other D3-* packages to version 3. The only incompatibility was the removal of d3 event. Relevant code was updated to use the new syntax.
Fixes #85

@Felix83000
Copy link

Hi,

All d3-color < 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds for previous versions.

Can you use this PR to push a new version of react-wordcloud?

If not I will stop using react-worldcloud as it becomes vulnerable....

Thanks for your help

Copy link

@Felix83000 Felix83000 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To fix d3-color vulnerabilitie, please use last version of
d3-scale
d3-scale-chromatic
d3-transition

@Felix83000
Copy link

Capture d’écran 2022-12-29 à 19 10 11

@ahmohamed
Copy link
Author

I'm not a maintainer of this package and don't have write access to this repo. The maintainer @chrisrzhou hasn't been responsive either. Personally I've been using my own fork directly. If @chrisrzhou wants to archive this repo, I'm happy to create another npm package with these updates (say react-wordcloud2).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Request to update d3-array dependency from 2.12.1 to 3.0.1

2 participants