react-simple-maps icon indicating copy to clipboard operation
react-simple-maps copied to clipboard

Please update d3-color dependency to >=3.1.0 (security fix)

Open jegly opened this issue 1 month ago • 0 comments

The current version of react-simple-maps depends on [email protected], which is vulnerable to a Regular Expression Denial of Service (ReDoS).

  • Affected package: d3-color (<3.1.0)
  • Patched version: 3.1.0
  • Root cause: react-simple-maps pins [email protected], preventing Dependabot from upgrading.

Request:
Please bump the dependency to d3-color@^3.1.0 (or a compatible range) so downstream projects can patch the vulnerability.

References:

Thanks for maintaining this project!

jegly avatar Dec 08 '25 07:12 jegly