search

plotly / react-plotly.js

A plotly.js React component from Plotly 📈
MIT License
1.01k stars 135 forks source link

Require higher version of plotly.js for latest release #296

Open nealpatel645 opened 1 year ago

nealpatel645 commented 1 year ago

When installing the latest version (2.6.0), it installs version 2.14.0 of plotly.js which has an indirect vulnerability: https://github.com/plotly/plotly.js/issues/6333

It looks like even latest version of plotly.js still uses d3-interpolate which depends on vulnerable d3-color.