React-color: retirejs find jquery in demo folder of tinycolor2

Created on 8 Oct 2018 · 5Comments · Source: casesandberg/react-color

Expected Behavior:

no retirejs warnings

Actual Behavior:

$ npx retire
Loading from cache: https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json
Loading from cache: https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/npmrepository.json
[..path..]/node_modules/tinycolor2/demo/jquery-1.9.1.js
 ↳ jquery 1.9.1 has known vulnerabilities: severity: medium; issue: 2432, summary: 3rd party CORS request may execute, CVE: CVE-2015-9251; https://github.com/jquery/jquery/issues/2432 http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/ https://nvd.nist.gov/vuln/detail/CVE-2015-9251 http://research.insecurelabs.org/jquery/test/ severity: medium; CVE: CVE-2015-9251, issue: 11974, summary: parseHTML() executes scripts in event handlers; https://bugs.jquery.com/ticket/11974 https://nvd.nist.gov/vuln/detail/CVE-2015-9251 http://research.insecurelabs.org/jquery/test/

Version: [email protected]

=> what to do? find something else/fork?
=> also made an issue at tinycolor2 but it does not seem to be alive :see_no_evil:
https://github.com/bgrins/TinyColor/issues/195

Source

daKmoR

Most helpful comment

Hi! how is this going? :)

vlaraort on 16 Sep 2019

👍2

All 5 comments

friendly reminder

if won't fix just let me know - no hard feelings 🤗

related question how much is this actually used? maybe this dependency can be dropped with same small specific helper functions?

daKmoR on 23 Jan 2019

Hmmm. Looking at this it looks like it is an error coming from jQuery in the tinycolor2 demo. We use tinycolor2 but none of their demo code or jQuery. We are working on version 3.0.0 of this package which drops tinycolor2 so this warning will go away then.

casesandberg on 23 Jan 2019

uh nice to hear :)
any rough ETA? 3, 6, 12, >12 months?

daKmoR on 23 Jan 2019

Soon, within the next month or two max.

On Tue, Jan 22, 2019 at 4:05 PM Thomas Allmer notifications@github.com
wrote:

uh nice to hear :)
any rough ETA? 3, 6, 12, >12 months?

—
You are receiving this because you commented.
Reply to this email directly, view it on GitHub
https://github.com/casesandberg/react-color/issues/550#issuecomment-456614015,
or mute the thread
https://github.com/notifications/unsubscribe-auth/AEa0JGPm9vvhWSd_u430flZR5trydanPks5vF6djgaJpZM4XNXyO
.