[Bug]: hull.js Code Injection Vulnerability #6605

Would you be willing to contribute to update the version of this dependency?

@Aarebecca https://github.com/antvis/G6/pull/6609

@Aarebecca 既然我们不想引入 github link 的库，是否有其他的替代库能避免这个库注入漏洞的问题？

@Rey-Wang 也许可以考虑将该库的源码拷贝至 G6 内部

Hello, this library was created more than 10 years ago. It is deprecated and not maintained, I would not recommend using it. I’d suggest to search for alternatives.

Some alternatives:

• https://github.com/mapbox/concaveman
• https://github.com/markroland/concaveHullJS
• https://turfjs.org/docs/api/concave

Hello! Could we re-open this issue? I see there is only one usage of this library. Trying to replace the current package by a maintained alternative sounds great! Is there anything we could do to help?

@YuLingCheng : Trying to replace the current package by a maintained alternative sounds great! Is there anything we could do to help?

Should be just: gather alternatives, check them for robustness, compatibility, and performance, then replace hull.js with the best alternative

Trying to replace the current package by a maintained alternative sounds great! Is there anything we could do to help?

You can conduct research on the libraries that are closest in capabilities to hull.js. You can consider several factors:

1. whether the functions meet the requirements
2. the size of the package
3. and whether the community is active.

Any news on defining the hull.js replacement?

@Rey-Wang 也许可以考虑将该库的源码拷贝至 G6 内部

It has already been in PR. For details, please refer to: https://github.com/antvis/G6/pull/6805

A typed copy of hull.js is better. However, since the author don't recommend using it any more + potential security risks, an existing alternative can be an instant upgrade than hull.js, and would be much easier for future maintainace. (Unless you are going to fix & improve hull.js to your own liking)

• For performance, concaveman is faster,
• Size-wise, @markroland/concave-hull is the smallest,
• concave in Turf.js is the most maintained package so far.

@zhongyunWan may I ask when we will release the fix?