# d3-selection-multi package.json update - d3.js

**URL:** <https://talk.observablehq.com/t/d3-selection-multi-package-json-update-d3-js/10019>\
**Category:** Help\
**Created:** [November 20, 2024, 11:54am UTC](https://talk.observablehq.com/t/d3-selection-multi-package-json-update-d3-js/10019 "2024-11-20T11:54:36Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Harisonic](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/harisonic/32/8915_2.png) [@Harisonic](https://talk.observablehq.com/u/Harisonic)\
**Post date:** [November 20, 2024, 11:54am UTC](https://talk.observablehq.com/t/d3-selection-multi-package-json-update-d3-js/10019/1 "2024-11-20T11:54:36Z")

</div>

I’m using d3-selection@3 and d3-transition@3 in my d3-custom package. I’m also using d3-selection-multi@1 package. But it’s dependency is d3-selection@1 and d3-transition@1 which cause reDoS vulnerability in d3-color Refer [https://security.snyk.io/package/npm/d3-color](https://security.snyk.io/package/npm/d3-color). Is it possible to update the version in d3-selection-multi package.json and release a new version?

---

<div class="post-metadata">

**Author:** ![Fil](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/fil/32/207_2.png) [@Fil](https://talk.observablehq.com/u/Fil)\
**Post date:** [November 23, 2024, 5:53am UTC](https://talk.observablehq.com/t/d3-selection-multi-package-json-update-d3-js/10019/2 "2024-11-23T05:53:42Z")

</div>

This module is obsolete, we recommend to migrate your code.

---

<div class="post-metadata">

**Author:** ![Harisonic](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/harisonic/32/8915_2.png) [@Harisonic](https://talk.observablehq.com/u/Harisonic)\
**Post date:** [November 24, 2024, 6:04pm UTC](https://talk.observablehq.com/t/d3-selection-multi-package-json-update-d3-js/10019/3 "2024-11-24T18:04:25Z")

</div>

Could you please explain more clearly about migrating?

---

<div class="post-metadata">

**Author:** ![Fil](https://yyz2.discourse-cdn.com/flex030/user_avatar/talk.observablehq.com/fil/32/207_2.png) [@Fil](https://talk.observablehq.com/u/Fil)\
**Post date:** [November 24, 2024, 10:31pm UTC](https://talk.observablehq.com/t/d3-selection-multi-package-json-update-d3-js/10019/4 "2024-11-24T22:31:42Z")

</div>

Where you have

```js
    .attrs({
      title: "A cheery, timeless greeting.",
      class: "greeting"
    })

```

replace with

```auto
    .attr("title", "A cheery, timeless greeting.")
    .attr("class", "greeting")

```

See [GitHub - d3/d3-selection-multi: Multi-value syntax for d3-selection and d3-transition.](https://github.com/d3/d3-selection-multi?tab=readme-ov-file#d3-selection-multi)