npm audit: 14 vulnerabilities

[matsamuel2018]

The latest version of @plotly/d3-sankey contains some vulnerabilities according to "npm audit":
14 vulnerabilities (11 moderate, 2 high, 1 critical)

I'm not using this package directly but instead it is being referenced through plotly.js (and I'm using plotly.js). But I'm just seeing if this project is active enough that perhaps these vulnerabilities will be addressed at some point. I'm certainly no expert with this but it appears that the vulnerabilities are related to packages that need upgrading to newer versions.

[alexcjohnson]

npm audit run on plotly.js itself shows no vulnerabilities, indicating that the vulnerabilities you're seeing here are all in devDependencies. Indeed, the critical vulnerability here is lodash, that only comes in via eslint so could only have an effect during tests. Issues in devDependencies almost never make their way into the final bundled package.

So yes, while it would be nice to keep this package updated, it's not a priority at this time.