Skip to content

Commit

Permalink
fix d3-color and potential security issue (opensearch-project#2454)
Browse files Browse the repository at this point in the history
* Resolve sub-dependent d3-color version and potencial security issue

* Addresses potential ReDoS issue from d3-color version < 3.1.0

Signed-off-by: Anan Zhuang <[email protected]>
  • Loading branch information
ananzh authored Sep 30, 2022
1 parent a528965 commit d802a3e
Show file tree
Hide file tree
Showing 4 changed files with 6 additions and 9 deletions.
1 change: 1 addition & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
* Bump moment-timezone from 0.5.34 to 0.5.37 ([#2361](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2361))
* [CVE-2022-33987] Upgrade geckodriver to 3.0.2 ([#2166](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2166))
* Bumps percy-agent to use non-beta version ([#2415](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2415))
* Resolve sub-dependent d3-color version and potential security issue ([#2454](https://github.com/opensearch-project/OpenSearch-Dashboards/pull/2454))

### 📈 Features/Enhancements

Expand Down
3 changes: 2 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -82,6 +82,7 @@
"**/ansi-regex": "^5.0.1",
"**/async": "^3.2.3",
"**/axios": "^0.27.2",
"**/d3-color": "^3.1.0",
"**/glob-parent": "^6.0.0",
"**/hoist-non-react-statics": "^3.3.2",
"**/json-schema": "^0.4.0",
Expand Down Expand Up @@ -460,4 +461,4 @@
"node": "14.20.0",
"yarn": "^1.21.1"
}
}
}
4 changes: 2 additions & 2 deletions src/dev/jest/config.js
Original file line number Diff line number Diff line change
Expand Up @@ -91,9 +91,9 @@ export default {
'^.+\\.html?$': 'jest-raw-loader',
},
transformIgnorePatterns: [
// ignore all node_modules except monaco-editor which requires babel transforms to handle dynamic import()
// ignore all node_modules except those which require babel transforms to handle dynamic import()
// since ESM modules are not natively supported in Jest yet (https://github.com/facebook/jest/issues/4842)
'[/\\\\]node_modules(?![\\/\\\\](monaco-editor|weak-lru-cache|ordered-binary))[/\\\\].+\\.js$',
'[/\\\\]node_modules(?![\\/\\\\](monaco-editor|weak-lru-cache|ordered-binary|d3-color))[/\\\\].+\\.js$',
'packages/osd-pm/dist/index.js',
],
snapshotSerializers: [
Expand Down
7 changes: 1 addition & 6 deletions yarn.lock
Original file line number Diff line number Diff line change
Expand Up @@ -6633,12 +6633,7 @@ d3-collection@1, d3-collection@^1.0.7:
resolved "https://registry.yarnpkg.com/d3-collection/-/d3-collection-1.0.7.tgz#349bd2aa9977db071091c13144d5e4f16b5b310e"
integrity sha512-ii0/r5f4sjKNTfh84Di+DpztYwqKhEyUlKoPrzUFfeSkWxjW49xU2QzO9qrPrNkpdI0XJkfzvmTu8V2Zylln6A==

d3-color@1, d3-color@^1.4.0:
version "1.4.1"
resolved "https://registry.yarnpkg.com/d3-color/-/d3-color-1.4.1.tgz#c52002bf8846ada4424d55d97982fef26eb3bc8a"
integrity sha512-p2sTHSLCJI2QKunbGb7ocOh7DgTAn8IrLx21QRc/BSnodXM4sv6aLQlnfpvehFMLZEfBc6g9pH9SWQccFYfJ9Q==

"d3-color@1 - 3", d3-color@^3.0.1:
d3-color@1, "d3-color@1 - 3", d3-color@^1.4.0, d3-color@^3.0.1, d3-color@^3.1.0:
version "3.1.0"
resolved "https://registry.yarnpkg.com/d3-color/-/d3-color-3.1.0.tgz#395b2833dfac71507f12ac2f7af23bf819de24e2"
integrity sha512-zg/chbXyeBtMQ1LbD/WSoW2DpC3I0mpmPdW+ynRTj/x2DAWYrIY7qeZIHidozwV24m4iavr15lNwIwLxRmOxhA==
Expand Down

0 comments on commit d802a3e

Please sign in to comment.