Giters

goccy / go-graphviz

Go bindings for Graphviz

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Graphviz Update?

lespea opened this issue · comments

commented

One of our internal scanning tools identified the following CVEs present in the included graphviz library: CVE-2019-9904 & CVE-2019-11023. I haven't validated those but I do believe the library is a handful of version behind anyway... not sure how much work it is updating the library code?

commented

Indeed, this looks like a valid question. Can we update Graphviz? It currently looks like the Graphviz source and GO source are intermingled. Can we do this differently?

commented

Do me a favor. I have the same problem

commented

Btw, this looks like a really great library. The description sounds like this is my dream.
So, this wasn't meant as criticism. I am more interested whether it makes sense to get involved... Hence my request. Can we create this maybe as a fork of Graphviz itself? With the sources of this library as true extension of this fork? I noticed that Graphviz got some maintainers and is picking up speed.

Or any better idea?

I am willing to add some hours to that endeavour as well, but only started learning Go, so I would need help.

commented

I'll prepare a mechanism to easily update the C source of Graphviz.
For example, use the following command ( make update/graphviz/{version})

make update/graphviz/2.40.1
commented

this sounds fantastic!

commented

I'll prepare a mechanism to easily update the C source of Graphviz. For example, use the following command ( make update/graphviz/{version})

make update/graphviz/2.40.1

I finally got you.
You are the god of salvation.
This is a moment to celebrate!

commented

Did you ever try to compile towards WebAssembly?

commented

I assume WebAssembly doesn't work:
imports github.com/goccy/go-graphviz/internal/ccall: build constraints exclude all Go files in ${MyPATH}/pkg/mod/github.com/goccy/go-graphviz@v0.0.9/internal/ccall

commented

Any updates on this?

commented

@Vithanco did you end-up having a functioning fork with updated upstream graphviz?

commented

Sorry, after some further consideration did I choose JavaScript over Go. But I still thinking this is a great library.

Thanks for the follow up & good luck!

commented

@goccy would love to see this happen - and of course happy to help if you can provide some pointers.

commented

The "Mend" tool complains about three CVEs in the embedded version of GraphViz. Consider replacing the current GraphViz source with newer source. I looked up Mend's complaints, here they are: