a vulnerability CVE-2020-15168 is introduced in open-vector-editor

[ayaka-kms]

Hi, a vulnerability CVE-2020-15168 is introduced in open-vector-editor via:
● [email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected] ➔ [email protected]

recompose is a legacy package. It has not been maintained for about 3 years, and is not likely to be updated.
Is it possible to migrate recompose to other package to remediate this vulnerability?

I noticed several migration records for recompose in other js repos, such as

1. in react-dnd, version 7.4.1 ➔ 7.4.2, remove recompose via commit
2. in @nivo/legends, version 0.67.0 ➔ 0.68.0, remove recompose via commit

Are there any efforts planned that would remediate this vulnerability or migrate recompose?

Thanks
; )

[tnrich]

Hey @ayaka-kms there are no plans at the moment to remove recompose from our toolchain but I think I would be open to a PR switching to use either acdlite/recompose#819 or https://github.com/react-recompose/react-recompose

A PR would also need to be made in https://github.com/TeselaGen/teselagen-react-components

[ayaka-kms]

@tnrich Thanks a lot.

[tnrich]

@ayaka-kms I switched out recompose for react-recompose which no longer has fbjs as a dep

Same with teselagen-react-components

You can get this change in [email protected]