Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐛 [BUG] fmin 0.0.2 depends on vulnerable version of rollup < 2.79.2 #3847

Open
elephantasticio opened this issue Mar 21, 2025 · 0 comments
Labels
Bug Something isn't working

Comments

@elephantasticio
Copy link

g2plot 2.4.32 depends on fmin 0.0.2 which depends on rollup < 2.79.2 which has a high severity vulnerability.

rollup  <2.79.2
Severity: high
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS - https://github.com/advisories/GHSA-gcx4-mw62-g8wm
fix available via `npm audit fix`
node_modules/fmin/node_modules/rollup
  fmin  <=0.0.2
  Depends on vulnerable versions of rollup
  node_modules/fmin
    @antv/g2plot  2.3.33 - 2.4.32
    Depends on vulnerable versions of fmin
    node_modules/@antv/g2plot

Solution: bump fmin version to 0.0.4

@elephantasticio elephantasticio added the Bug Something isn't working label Mar 21, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant