[Snyk] Upgrade chart.js from 2.8.0 to 2.9.4 #5
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Snyk has created this PR to upgrade chart.js from 2.8.0 to 2.9.4. See this package in npm: https://www.npmjs.com/package/chart.js See this project in Snyk: https://app.snyk.io/org/unisys/project/28276259-2a36-4ccb-a42c-a849b6f99509?utm_source=github&utm_medium=upgrade-pr
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Snyk has created this PR to upgrade chart.js from 2.8.0 to 2.9.4.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version fixes:
SNYK-JS-CHARTJS-1018716
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
(*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: chart.js
-
2.9.4 - 2020-10-18
- #7404 - Preserve prototypes when cloning. Thanks @ iddings
- #7587 - Fix docs for external moment.js. Thanks @ mojoaxel
- #7853 - Fix box recursion when dimensions are NaN. Thanks @ alessandroasm
- #7883 - Fix call stack exception when computing label sizes. Thanks @ silentmatt
- #7918 - Prevent global prototype pollution via the merge helper
- #7920 - Use Object.create(null) as
-
2.9.3 - 2019-11-14
- #6698 Fix undefined variable
- #6719 Don't make legend empty when fill is false
-
2.9.2 - 2019-11-02
- #6641 IE11 & Edge compatible style injection
- #6655 Backwards compatible default fill for radar charts
- #6660 Improve clipping of line charts when border widths are large
- #6661 When a legend item is clicked, make sure the correct item is hidden
- #6663 Refresh package-lock file to pick up new dependency
- #6671 Stop unnecessary line calculations
- #6643 Combine performance documentation sections
-
2.9.1 - 2019-10-27
- #6603 Fix deprecation warnings for horizontal bar charts
- #6608 Fix zoom plugin by no longer clipping
- #6617 Non numeric Y axes did not work
- #6613 Add link to performance documentation
- #6609 - Tests no longer use deprecated options
-
2.9.0 - 2019-10-26
-
2.8.0 - 2019-03-14
from chart.js GitHub release notesThis is the last release of v2 and focused on fixing bugs identified in the v2.9.3 release.
Bugs Fixed
mergetarget, to prevent prototype pollutionBug Fixes
Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@ kurkle, @ benmccann, and @ etimberg).
Bug Fixes
Performance
Documentation
Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@ nagix, @ kurkle, @ benmccann, @ etimberg and @ simonbrunel).
Bug Fixes
scale.getDecimalForPixelto the chart areaDocumentation
Development
Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@ nagix, @ kurkle, @ benmccann, @ etimberg and @ simonbrunel).
Commit messages
Package name: chart.js
Compare
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
🧐 View latest project report
🛠 Adjust upgrade PR settings
🔕 Ignore this dependency or unsubscribe from future upgrade PRs