Vulnerability CWE-400: d3-color vulnerable to ReDoS

[agforero]

Hey there,

It appears that the current version of react-simple-maps relies on a vulnerable version of another package, d3-color. My team and I are getting the following Dependabot Alert:

Dependabot cannot update d3-color to a non-vulnerable version

The latest possible version that can be installed is 2.0.0 because of the following conflicting dependencies:

[email protected] requires d3-color@1 - 2 via a transitive dependency on [email protected]
[email protected] requires d3-color@1 - 2 via a transitive dependency on [email protected]
No patched version available for d3-color

The earliest fixed version is 3.1.0.

react-simple-maps has to upgrade to d3-color version 3.1.0 or higher.

[OleksiiKachan]

there is workaround #349 (comment)