Security concern: CWE-400 via d3-color

[kikienelsone]

Hi!

We`re currently using 'react-simple-map' in our project, and noticed that it indirectly depends on 'd3-color'.
This version of 'd3-color' is affected by a vulnerability classified as CWE-400: Uncontrolled Resource Consumption. The issue has been reported in our audit tools

The issue is fixed in d3-color@3.1.0, but react-simple-maps depends on packages (like d3-interpolate) that still pull in the vulnerable version.

[albertyanzz]

As mentioned elsewhere, a current workaround is to include an override in your own package.json. #349 (comment)

The fix for this issue was actually committed to this repo a while back, but the change was never published to npm. Thus, another way to approach this is using

"react-simple-maps": "git+https://github.com/zcreativelabs/react-simple-maps.git"

In your package.json dependencies. Or, to be more precise, use the exact commit hash:

"react-simple-maps": "git+https://github.com/zcreativelabs/react-simple-maps.git#b322da59a76fa789de1de77165bbef6df9beb0ef"