Repository navigation
npm audit: 14 vulnerabilities #10
Description
The latest version of @plotly/d3-sankey contains some vulnerabilities according to "npm audit":
14 vulnerabilities (11 moderate, 2 high, 1 critical)
I'm not using this package directly but instead it is being referenced through plotly.js (and I'm using plotly.js). But I'm just seeing if this project is active enough that perhaps these vulnerabilities will be addressed at some point. I'm certainly no expert with this but it appears that the vulnerabilities are related to packages that need upgrading to newer versions.
Activity
alexcjohnson commentedon Feb 25, 2022
npm auditrun on plotly.js itself shows no vulnerabilities, indicating that the vulnerabilities you're seeing here are all indevDependencies. Indeed, the critical vulnerability here islodash, that only comes in viaeslintso could only have an effect during tests. Issues indevDependenciesalmost never make their way into the final bundled package.So yes, while it would be nice to keep this package updated, it's not a priority at this time.