vulnerability in XLSX

[dstarzyknetpr]

Can you update amchart, because current version has vulnerability in XLSX?
GHSA-4r6h-8v6p-xvw6

All versions of SheetJS CE through 0.19.2 are vulnerable to "Prototype Pollution" when reading specially crafted files. Workflows that do not read arbitrary files (for example, exporting data to spreadsheet files) are unaffected.

[robrichardson27]

Looks like SheetJS no longer publish to npm: SheetJS/sheetjs#2822

[martynasma]

Correct. They are not publishing to NPM anymore, so it's difficult for us to use it as a dependency with newer versions.

In amCharts 5, we're preparing an update that bundles hard-copy of their latest version off of their own Git. More info.

We will consider something similar for amCharts 4, too. Just not yet sure when/if that will happen because amCharts 4 is already on dev freeze, and this particular vulnerability does not affect any of the functionality used in amCharts.

[martynasma]

Fixed in 4.10.36.

[4.10.36] - 2023-05-18

Added

• New locale: Faroese (fo_FO). Thanks Martin Puge.

Changed

• A link object that was created with linkWith for ForceDirectedNode is pushed to the child node's data items childLinks array and also node.linksWith list.
• Removed xlsx package (with vulnerability) from dependencies in favor of a bundled hard copy (version 0.19.3) due to their decision not to publish to NPM. (Issue 4261).

Fixed

• In some cases, when a series was removed from a SerialChart it was not disposing one of the listeners and could remain in the memory.
• Grip rollover labels of a vertical Scrollbar were showing opposite values.