Update dependency chart.js to ~2.9.0 [SECURITY] #538
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠ Warning: custom changes will be lost. |
Renovate Ignore NotificationBecause you closed this PR without merging, Renovate will ignore this update (~2.9.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
~2.6.0->~2.9.0GitHub Vulnerability Alerts
CVE-2020-7746
This affects the package chart.js before 2.9.4. The options parameter is not properly sanitized when it is processed. When the options are processed, the existing options (or the defaults options) are deeply merged with provided options. However, during this operation, the keys of the object being set are not checked, leading to a prototype pollution.
Release Notes
chartjs/Chart.js
v2.9.4Compare Source
This is the last release of v2 and focused on fixing bugs identified in the v2.9.3 release.
Bugs Fixed
mergetarget, to prevent prototype pollutionv2.9.3Compare Source
Bug Fixes
Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@kurkle, @benmccann, and @etimberg).
v2.9.2Compare Source
Bug Fixes
Performance
Documentation
Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@nagix, @kurkle, @benmccann, @etimberg and @simonbrunel).
v2.9.1Compare Source
Bug Fixes
scale.getDecimalForPixelto the chart areaDocumentation
Development
Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@nagix, @kurkle, @benmccann, @etimberg and @simonbrunel).
v2.9.0Compare Source
Breaking changes
helpers._decimalPlacesis now privateEnhancements
dataset.orderautoSkipaware of major ticksoffsetGridLinesis truespanGapsin radar chartspointStyleimage[start, end])minandmaxin standard mannerPerformance
helpers.eachticks.sampleSizeoptionticks.source:'labels'helpers.eachwith for-loopscore.layoutgetScaleForId()calls in the line controllerhelpers.extendBug Fixes
autoSkipis enabledzeroLineIndexis definedtoExponentialbetween 0 and 20. Thanks @veggiesaurusgetValueForPixelin time scalelineTensiontick.majorintickFormatFunctiondetermineUnitForFormattingfloating point errorticks.minorandticks.majorissueshelpers.almostWholeDocumentation
elements.arc.anglein documentationticks.displayand addpointLabels.displaycubicInterpolationModeandfill. Thanks @stockiNailDevelopment
autoSkipinupdatehelpers.math._factorizeThanks to the maintainers and collaborators for their help to improve and test Chart.js (@nagix, @kurkle, @benmccann, @etimberg and @simonbrunel).
v2.8.0: Version 2.8.0Compare Source
Documentation: http://www.chartjs.org/docs/2.8.0/
Deprecations
Chart.{Type}classesconfigMergeandscaleMergehelpersEnhancements
minBarLengthoption for bar chart. Thanks @adubereversesupport to time scaleonLeavecallback to legend. Thanks @jonrimmerIssues Fixed
offsetGridLinebehavior with a single data pointdata.labelslineWidthas an arraynew Number()is correctly handledstepSizeinnerHTMLusage from our DOM platformafterBuildTicksscale.pointLabels.lineHeightandscale.ticks.lineHeightoptionsautoSkipistrueticks.reverseissuegetRightValueto number in bar chartfitWithPointLabelscalculation in radial linear scalexLabelandyLabelwithlabelandvalueusePointStyleistrue. Thanks @alfiehdinsertElementsgetAreaimplementation for horizontal barsaddEventListenerandremoveEventListenerdataset.dataarraysDocumentation
aspectRatioproperty. Thanks @danielcb29parserinstead of the deprecatedformatoption. Thanks @Niladri24duttapaddingoption. Thanks @JEphronchartjs-plugin-colorschemesbarThickness. Thanks @jedrekdomanskiomi-chartto the doc. Thanks @dntzhangChart.min.jsin samplesmaintainAspectRatio. Thanks @janelledementpointBackgroundColorin radar samplechartjs-plugin-crosshair. Thanks @AbelHeinsbroekchartjs-plugin-roughDevelopment
*.jstest fixture configs.editorconfigfile to include newlines at EOF. Thanks @jtagschererChart.controllers.*importablegulp-connectand add jsdelivr/unpkg pathshelpers.options.resolveremoveResizeListener. Thanks @DanielRufThanks to the maintainers and collaborators for their help to improve and test Chart.js (@nagix, @kurkle, @benmccann, @etimberg and @simonbrunel).
More details in the release PR: #6092
v2.7.3: Version 2.7.3Compare Source
Documentation: http://www.chartjs.org/docs/2.7.3/
Enhancements
ticks.precisionoption to linear scaleIssues Fixed
responsive: trueand Chart is hidden. Thanks @jcopperfieldDocumentation
Development
Chart.Animation/animations/TooltipimportableChart.Scale/scaleServiceimportableMore details in the release PR: #5732
v2.7.2: Version 2.7.2Compare Source
Documentation: http://www.chartjs.org/docs/2.7.2/
Enhancements
point.xRangeandpoint.yRangeperformance. Thanks @fanthosIssues Fixed
time.unitoption to create default min/max for empty chart. Thanks @jcopperfieldChart.Ticks.formattersDocumentation
legendCallback. Thanks @cameroncfDevelopment
Chart.layout(Service)importableChart.pluginsimportableChart.layouttoChart.layoutspackage-lock.jsonshowLinesin scatter chart. Thanks @loicbourgoisMore details in the release PR: #5145
v2.7.1: Version 2.7.1Compare Source
2.7.1 is a bug fix release and also includes numerous documentation improvements
Documentation: http://www.chartjs.org/docs/2.7.1/
Enhancements
beforeTooltipDrawandafterTooltipDrawto plugins. Thanks @JewelsJLFIssues Fixed
nullstyle. Thanks @RydoriextendandinheritshelpersDocumentation
Development
More details in the release PR: #4876
v2.7.0: Version 2.7.0Compare Source
Version 2.7 brings better stability, and powerful new features to Chart.js. The bubble chart options are now completely scriptable. This means that you can pass a function to a bubble chart dataset property and have the function be called as needed. This simplifies array properties, and allows quick and easy rendering changes based on data values. Check out the sample for details. If these options prove useful, they can be extended to other chart types in the future.
Building off the time scale rewrite in version 2.6, the time scale now supports options for configuring how labels generate ticks, how interpolation between the points is handled and the scale boundary strategy. Users can now configure ticks to be generated for each label, or be determined automatically from the data limits. Users can also change how ticks are distributed along the axis] to make non-linear time axes. Check out the sample for details.
Documentation: http://www.chartjs.org/docs/2.7.0/
Breaking Changes
2to be consistent with other charts and are not square anymore by default. Use theaspectRatio: 1option to restore the previous behaviour.Deprecations
unitStepSize, usestepSizeinstead.New Features
labelTextColorcallback. Thanks @apoorvasrinivasanmajorunit options. Thanks @hurskiy-andriydevicePixelRatiooption. Thanks @OlduwanSteveaxis: 'x', 'y', 'xy'options.distributionandticks.sourceoptions.Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.