[Snyk] Upgrade chart.js from 2.9.3 to 2.9.4

[snyk-bot]

Snyk has created this PR to upgrade chart.js from 2.9.3 to 2.9.4.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 1 version ahead of your current version.
• The recommended version was released 25 days ago, on 2020-10-18.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Prototype Pollution SNYK-JS-CHARTJS-1018716	696/1000 Why? Proof of Concept exploit, Has a fix available, CVSS 7.5	Proof of Concept

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: chart.js

• 2.9.4 - 2020-10-18
  

  This is the last release of v2 and focused on fixing bugs identified in the v2.9.3 release.

  Bugs Fixed

  • #7404 - Preserve prototypes when cloning. Thanks @iddings
  • #7587 - Fix docs for external moment.js. Thanks @mojoaxel
  • #7853 - Fix box recursion when dimensions are NaN. Thanks @alessandroasm
  • #7883 - Fix call stack exception when computing label sizes. Thanks @silentmatt
  • #7918 - Prevent global prototype pollution via the merge helper
  • #7920 - Use Object.create(null) as merge target, to prevent prototype pollution
• 2.9.3 - 2019-11-14
  

  Bug Fixes

  • #6698 Fix undefined variable
  • #6719 Don't make legend empty when fill is false

  Thanks to the maintainers and collaborators for their help to improve and test Chart.js (@kurkle, @benmccann, and @etimberg).

from chart.js GitHub release notes

Commit messages

Package name: chart.js

• 1d92605 Use Object.create(null) as `merge` target (#7920)
• dff7140 When objects are merged together, the target prototype can be polluted. (#7918)
• d919188 Bump verison number to v2.9.4
• 42ed589 Fix Maximum call stack size exception in computeLabelSizes (#7883)
• 063b7dc [2.9] FitBoxes recursion when dimensions are NaN (#7853)
• 2493cb5 Use node v12.18.2 on Travis CI (#7864)
• 679ec4a docs: fix rollup external moment (#7587)
• 484f0d1 Preserve object prototypes when cloning (#7404)
• 2df6986 Look for any branch starting with release (#7087) (#7089)

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs