[CVE-2024-34156] Security vulnerability in D2

[JGoggers]

Hello 😄

Shield has reported that the following vulnerability was found:

CVE-2024-34156 found in usr/bin/d2. Package stdlib is on v1.23.0 when it should be on either v1.22.7 or v1.23.1. We use the image yuzutech/kroki:latest. Could you please look into this?

[ggrossetie]

You should report this vulnerability (if it hasn’t already been reported/fixed) to https://github.com/terrastruct/d2. Kroki uses the latest available version, so once the vulnerability is fixed in D2 it will be available in Kroki.

We are currently using version 0.7.0. I’m going to update to use version 0.7.1, but I don’t know if this vulnerability has been fixed in that version: https://github.com/terrastruct/d2/releases/tag/v0.7.1