search

decaporg / decap-cms

A Git-based CMS for Static Site Generators
https://decapcms.org
MIT License
17.7k stars 3.03k forks source link

Replace validate-color in color widget #7007

Closed martinjagodic closed 7 months ago

martinjagodic commented 7 months ago

This is the only place where it's used, so it should be easy to replace: https://github.com/decaporg/decap-cms/blob/master/packages/decap-cms-widget-colorstring/src/ColorControl.js#L134

There is also a vulnerability reported for validate-color when installing the latest version of decap-cms:

✗ Denial of Service (DoS) [High Severity][https://security.snyk.io/vuln/SNYK-JS-VALIDATECOLOR-2935878] in validate-color@2.2.4
introduced by decap-cms-app@3.0.12 > decap-cms-widget-colorstring@3.0.2 > validate-color@2.2.4
No upgrade or patch available

Originally posted by @kl-ma in https://github.com/decaporg/decap-cms/issues/6513#issuecomment-1841410048