Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update vulnerable packages #1682

Closed
FreeFrags opened this issue May 7, 2024 · 2 comments
Closed

Update vulnerable packages #1682

FreeFrags opened this issue May 7, 2024 · 2 comments
Assignees
Labels

Comments

@FreeFrags
Copy link

We installed antd and run npm audit.

And found that these dependencies have vulnerablabilities.

d3-color  <3.1.0
Severity: high
d3-color vulnerable to ReDoS - https://github.com/advisories/GHSA-36jr-mh4h-2g58
fix available via `npm audit fix`
node_modules/d3-color
  @antv/g-lite  *
  Depends on vulnerable versions of d3-color
  node_modules/@antv/g-lite
    @antv/g  >=5.8.9
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g
      @ant-design/plots  >=2.0.0-alpha.0
      Depends on vulnerable versions of @antv/g
      Depends on vulnerable versions of @antv/g2
      Depends on vulnerable versions of @antv/g2-extension-plot
      node_modules/@ant-design/plots
      @antv/component  >=1.0.0-beta.1
      Depends on vulnerable versions of @antv/g
      node_modules/@antv/component
        @antv/g2  >=5.0.17
        Depends on vulnerable versions of @antv/component
        Depends on vulnerable versions of @antv/g-plugin-dragndrop
        node_modules/@antv/g2
          @antv/g2-extension-plot  *
          Depends on vulnerable versions of @antv/g2
          node_modules/@antv/g2-extension-plot
    @antv/g-camera-api  *
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-camera-api
    @antv/g-canvas  >=1.9.0
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-canvas
    @antv/g-dom-mutation-observer-api  *
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-dom-mutation-observer-api
    @antv/g-plugin-canvas-path-generator  >=1.1.12
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-plugin-canvas-path-generator
      @antv/g-plugin-canvas-picker  <=1.0.0-alpha.32 || 1.1.8-alpha.0 - 1.6.0 || >=1.8.9
      Depends on vulnerable versions of @antv/g-lite
      Depends on vulnerable versions of @antv/g-plugin-canvas-path-generator
      Depends on vulnerable versions of @antv/g-plugin-canvas-renderer
      node_modules/@antv/g-plugin-canvas-picker
      @antv/g-plugin-canvas-renderer  1.1.8-alpha.0 - 1.6.0 || >=1.7.15
      Depends on vulnerable versions of @antv/g-lite
      Depends on vulnerable versions of @antv/g-plugin-canvas-path-generator
      node_modules/@antv/g-plugin-canvas-renderer
    @antv/g-plugin-dom-interaction  >=1.7.12
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-plugin-dom-interaction
    @antv/g-plugin-dragndrop  >=1.6.12
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-plugin-dragndrop
    @antv/g-plugin-html-renderer  >=1.7.12
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-plugin-html-renderer
    @antv/g-plugin-image-loader  >=1.1.13
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-plugin-image-loader
    @antv/g-web-animations-api  *
    Depends on vulnerable versions of @antv/g-lite
    node_modules/@antv/g-web-animations-api

18 high severity vulnerabilities
@xiaoiver xiaoiver self-assigned this May 8, 2024
@xiaoiver
Copy link
Contributor

xiaoiver commented May 8, 2024

I'll upgrade d3-color from 1.x to 3.x asap.
https://security.snyk.io/vuln?search=d3-color

But actually I have tried this a few months ago and failed.
#1282

But now maybe I can use Victory charts instead of d3 deps.
recharts/recharts@bcb199c

@xiaoiver xiaoiver added the bug label May 8, 2024
@FreeFrags
Copy link
Author

Thanks! looking forward to the update

xiaoiver added a commit that referenced this issue May 23, 2024
xiaoiver added a commit that referenced this issue May 23, 2024
* fix: update to d3-color@3 #1682

* chore: commit changeset
xiaoiver added a commit that referenced this issue May 23, 2024
* fix: update d3-color to solve vulnerable problem (#1691)

* fix: update to d3-color@3 #1682

* chore: commit changeset

* chore(release): bump version (#1692)

Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

---------

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants