search

plotly / plotly.js

Open-source JavaScript charting library behind Plotly and Dash
https://plotly.com/javascript/
MIT License
17.01k stars 1.86k forks source link

Static-eval security issue reported by npm audit #4407

Closed goldengecko closed 4 years ago

goldengecko commented 4 years ago

To reproduce, install plotly.js in a project, and run npm audit.

Expected outcome: no security issues. Actual outcome: reports an issue due to the version of static-eval linked to in the package. Fix: update the static-eval version to >= 2.0.2. See https://www.npmjs.com/advisories/758

There are 16 security alerts generated, but they all refer to the same issue, as shown in the attached image.

Screen Shot 2019-12-04 at 12 03 31 pm

etpinard commented 4 years ago

Duplicate of https://github.com/scijs/cwise/issues/19

Ionaru commented 4 years ago

@etpinard You are referring to an issue that is 2 years old, the PR ( https://github.com/scijs/cwise/pull/25 ) that is meant to fix the security vulnerability has had no meaningful update or discussion since Jul 25, 2019.

At this point I think it's fair to assume the vulnerability will not be fixed at cwise's side, and I suggest looking into alternatives.

stephanvierkant commented 4 years ago

Why is this issue closed? There are still security issues with cwise.

They may not cause direct issues with this repo, but at some point a non-maintained dependency with security issues should be fixed or replaced.

nicolaskruchten commented 4 years ago

We're tracking this in https://github.com/plotly/plotly.js/issues/4796 now :)