Dependabot shows alert for long time, but updating three.js to the newest version was not a trivial task because many of the compatibilities were broken.
We examined incompatibilities and fixed them. In particular, the removal of Geometry class and access to vertices buffer after a BufferedGeometry was created were a big change that needed to copy the whole PolyhedronGeometry and create customized version of it.
Dependabot shows alert for long time, but updating three.js to the newest version was not a trivial task because many of the compatibilities were broken.
We examined incompatibilities and fixed them. In particular, the removal of Geometry class and access to vertices buffer after a BufferedGeometry was created were a big change that needed to copy the whole PolyhedronGeometry and create customized version of it.