Replace graphviz-react with a direct d3-graphviz wrapper (abandoned package, vulnerable deps)

[wrigjl]

Problem

components/Visualization/Graphvisualization.js depends on graphviz-react, which:

• Last published: October 2022 (nearly 3 years ago)
• 6 open PRs, unmerged — repo is effectively abandoned
• Vendors its own ancient d3-graphviz@^2.6.1 internally, ignoring the d3-graphviz version in our own package.json

This causes a cascade of high-severity vulnerabilities from graphviz-react's pinned-old transitive deps:

Package	Vulnerable range	Severity
graphviz-react	*	high
d3-graphviz	<=4.5.0	high
d3-color	<3.1.0	high (ReDoS)
d3-interpolate	0.1.3 - 2.0.1	high
d3-transition	0.0.7 - 2.0.0	high
d3-zoom	0.0.2 - 2.0.0	high

Proposed fix

We already have d3-graphviz@^5.6.0 (the current maintained version) in package.json. The fix is to:

1. Write a thin React wrapper around d3-graphviz directly (~30 lines, useEffect + a <div ref>)
2. Drop graphviz-react from package.json

The API surface in Graphvisualization.js is minimal — it only uses <Graphviz dot={...} options={...} /> — so the replacement would be a drop-in with no call-site changes.

Related

See also #91 (cleanup of other unused files). testAutoProb.js (proposed for deletion there) is the only other user of graphviz-react.