Studio-2364 Update d3-color and remove d3-color-difference dependency #6
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tristen
requested changes
May 27, 2024
package.json
Outdated
| @@ -1,6 +1,6 @@ | |||
| { | |||
| "name": "@mapbox/to-color", | |||
| "version": "2.1.0", | |||
| "version": "3.0.0", | |||
There was a problem hiding this comment.
Suggested change
| "version": "3.0.0", | |
| "version": "2.1.1", |
I think this can just be a patched version as no functionality has changed in the build.
tristen
approved these changes
May 27, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
d3-color needs to be updated to get rid of critical security vulnerability, but d3-color-difference package hasn't been updated in 6 years and still uses old version of d3-color.
I tried to search and use alternative libraries (such as color-diff), but it looks like the results are different.
In the end since we are using just the differenceCiede2000 method I just copied this and its test from the original package, removed d3-color-difference and added direct dependency to d3-color.
Also had to add jest config and babel config because d3-color switched esm and tests weren't working anymore
Related ticket STUDIO-2364 Address security vulnerabilities in Studio