Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Flot-axis still in Yarn.lock file under Components folder #9700

Closed
CarpFlop opened this issue Mar 8, 2024 · 3 comments
Closed

Flot-axis still in Yarn.lock file under Components folder #9700

CarpFlop opened this issue Mar 8, 2024 · 3 comments

Comments

@CarpFlop
Copy link

CarpFlop commented Mar 8, 2024

Flot-axis was removed from everywhere except yarn.lock.

It's a malicious package with a Synk rating of 9.8/10 Criticality.
Please hotfix for part of latest release that was meant to address this issue!

Thank you guys for your hard work

@CarpFlop
Copy link
Author

CarpFlop commented Mar 8, 2024

#9187 Potentially false positive:

But since all references and usage of flot-axislabels was removed in latest update, potentially still worth cleaning up lingering reference in lockfile

@mtesauro
Copy link
Contributor

@CarpFlop Agree that this appears to be lingering cruft vs a real issue as this library was removed in #9540

I do agree we should remove that reference if for no other reason to remove confusion.

manuel-sommer added a commit to manuel-sommer/django-DefectDojo that referenced this issue Mar 10, 2024
mtesauro pushed a commit that referenced this issue Mar 11, 2024
@manuel-sommer
Copy link
Contributor

This can be close @mtesauro ;-) was already released.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants