Example page - Rocket Trajectory uses old version of charts.js which has high security vulnerability

[scotroach]

Example page: math.js | rocket trajectory optimization
Uses Chart.js 2.5.0
Which has a High Security Vulnerability (CVE-2020-7746)

Because of this, application security scanners are reporting Security Vulnerabilities because the sample pages are included in the npm packaging.

[josdejong]

Thanks for bringing this up. Makes sense to me to remove the examples and also the docs from the npm package: you can use the examples and docs from the website https://mathjs.org, and also from the git repo.

This will require changes in the script that generates the website, which is a gh-pages website. This currently copies the examples and docs from the npm package, see: https://github.com/josdejong/mathjs/blob/gh-pages/gulpfile.js

[josdejong]

Hm, I realize the website build script needs both the npm package (math.js bundle) and the docs and examples. That means we would need both the git repo and the npm package 🤔 . Maybe we need to install the repo as a git sub module or something.

Help to work this out would be welcome!

[anjanapr]

Is there any update on this issue?

[josdejong]

No, it's not yet picked up by anyone. Help would be welcome 😄

[josdejong]

I've created two PR's to address this issue: #2555 and #2557. Feedback on the PR's would be welcome. If not I'll merge this in a few days or so.