[Snyk] Upgrade canvas from 2.9.1 to 2.10.2 #12

snyk-bot · 2022-12-30T01:51:55Z

Snyk has created this PR to upgrade canvas from 2.9.1 to 2.10.2.

As this is a private repository, Snyk-bot does not have access. Therefore, this PR has been created automatically, but appears to have been created by a real user.

✨ Snyk has automatically assigned this pull request, set who gets assigned.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

The recommended version is 5 versions ahead of your current version.
The recommended version was released 2 months ago, on 2022-10-30.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MOMENT-2944238	482/1000 Why? Proof of Concept exploit, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: canvas

2.10.2 - 2022-10-30
Fixed
- Fix Assertion failed: (object->InternalFieldCount() > 0), function Unwrap, file nan_object_wrap.h, line 32. (#2025)
- textBaseline and textAlign were not saved/restored by save()/restore(). (#1936)
- Update nan to v2.17.0 to ensure Node.js v18+ support.
Changed
- Improve performance and memory usage of save()/restore().
- save()/restore() no longer have a maximum depth (previously 64 states).
2.10.1 - 2022-09-07
Fixed
- Fix actualBoundingBoxLeft and actualBoundingBoxRight when textAlign='center' or 'right' (#1909)
- Fix rgba(r,g,b,0) with alpha to 0 should parse as transparent, not opaque. (#2110)
2.10.0 - 2022-09-04
Added
- Export pangoVersion
- ctx.roundRect()
Fixed
- rgba(r,g,b) with no alpha should parse as opaque, not transparent. (#2029)
- Typo in PngConfig.filters types. (#2072)
- createPattern() always used "repeat" mode; now supports "repeat-x" and "repeat-y". (#2066)
- Crashes and hangs when using non-finite values in context.arc(). (#2055)
- Incorrect context.arc() geometry logic for full ellipses. (#1808, (#1736))
- Added missing deregisterAllFonts to the Typescript declaration file (#2096)
- Add User-Agent header when requesting remote images (#2099)
2.9.3 - 2022-06-24
Fixed
- Wrong fonts used when calling registerFont multiple times with the same family name (#2041)
2.9.2 - 2022-06-23
Fixed
- All exports now work when Canvas is used in ES Modules (ESM). (#2047)
- npm rebuild will now re-fetch prebuilt binaries to avoid NODE_MODULE_VERSION mismatch errors. (#1982)
2.9.1 - 2022-03-19
Fixed
- Stringify CanvasGradient, CanvasPattern and ImageData like browsers do. (#1639, #1646)
- Add missing include for toupper.
- Throw an error instead of crashing the process if getImageData or putImageData is called on a PDF or SVG canvas (#1853)
- Compatibility with Typescript 4.6
- Near-perfect font matching on Linux (#1572)
- Fix multi-byte font path support on Windows.

from canvas GitHub release notes

Commit messages

Package name: canvas

672104c v2.10.2
cc32159 src: shorten receiver checks
ad18c6c src: shorten copy assignment operator decl for Point
2876b6e Bugfix/Node.js 18 -> Assertion failed: (object->InternalFieldCount() > 0) (#2133)
0e6504a remove save() limit, improve save/restore perf, fix some props
b3e7df3 v2.10.1
bc75c6a add line in CHANGELOG
9374943 Parse rgba(r,g,b,0) correctly
6862532 Fix actualBoundingBoxLeft/Right with center/right alignment (#2109)
561d933 v2.10.0
3fb4ed9 fix: add user agent to remote images request
dce0fd1 Add roundRect() support
eba1e4a Adds deregisterAllFonts to the typescript declaration file (#2096)
10b208e un-skip 2d.path.arc.nonfinite; now fixed
73d7893 fix arc geometry calculations
a484cf2 fix crashes and hangs in arc()
288f4bf add WPT tests
bdc497a Use node-gyp 8.x for Win CI
c6a1546 fix repeat-x/y support in createPattern()
f8d4949 Fix FITLER/FILTER typo in index.d.ts
5255195 Parse rgba(r,g,b) correctly
b0d4f44 Update instructions for OSX local build
64fdf18 export pangoVersion to help debugging
7a8a606 v2.9.3