Security vulnerability in d3-interpolate

[azhirnova]

Hi there, there is a security vulnerability in the d3-color package (dependency of d3-interpolate) versions before 3.1.0. I was wondering if you were planning to bump d3-interpolate to the latest version any time soon?

[rodoabad]

Bumping this one since it's being reported now as a high vulnerability.

[ckifer]

Please see discussion in #3012

[rodoabad]

Thanks, @ckifer !

[rodoabad]

I'm seeing this in the alpha release as well - https://github.com/recharts/recharts/blob/2.3.0-alpha.x/package.json#L89 where we're using the new version.

[ckifer]

@rodoabad yeah I'm trying to do an alpha release to test that this doesn't break things, however I think alpha.0 left the vulnerability fix out.

I do not have publish permissions so this has been tricky. I will try to get alpha.1 published tonight that will have the fix. Its reliant on a response and action from the owner though

[ckifer]

https://www.npmjs.com/package/recharts/v/2.3.0-alpha.1

please help me test this! Thanks!

[rodoabad]

Thanks for the update @ckifer, we'll try and test this tomorrow for ya!

[rodoabad]

@ckifer tested it in our applications and it works for us.

[rodoabad]

Automated tests pass, manual tests passed, we're confident in this version as the stable version.

[ckifer]

Awesome, much appreciated!

Going to wait a few more days or so to let others test and then release 2.3.