esnet / esnet/react-timeseries-charts
"merge" lib. dependency
Open
- Dominant language
- JavaScript
- Stars
- 876
- Forks
- 279
- PR merge metrics
- No merged PRs in 30d
Description
# 🐛Bug report
**Describe the bug**
there is a problem with "merge" dependency:
**To Reproduce**
npx create-react-app xxx
npm install react-timeseries-charts
npm audit
this will return:
```
merge <2.1.1
Severity: high
Prototype Pollution in merge - https://github.com/advisories/GHSA-7wpw-2hjm-89gp
No fix available
node_modules/merge
react-timeseries-charts *
Depends on vulnerable versions of merge
node_modules/react-timeseries-charts
```
Contributor guide
Assessment
This issue has not been assessed yet.