chore(deps): bump jspdf from 3.0.3 to 4.0.0 by dependabot[bot] · Pull Request #131 · ever-co/ever-rec

dependabot · 2026-01-05T18:20:00Z

Bumps jspdf from 3.0.3 to 4.0.0.

Release notes

v4.0.0

This release fixes a critical path traversal/local file inclusion security vulnerability in the jsPDF Node.js build. File system access is now restricted by default and can be enabled by either using node's --permission flag or the new jsPDF.allowFsRead property.

There are no other breaking changes.

v3.0.4

This release includes a bunch of bugfixes. Thanks to all contributors!

What's Changed

[Snyk] Upgrade @babel/runtime from 7.28.3 to 7.28.4 by @MrRio in parallax/jsPDF#3895

fix: cell function now properly accepts align parameter by @vishal-rathod-07 in parallax/jsPDF#3896

Remove duplicated function "ga" from WebPDecoder.js by @jvdp in parallax/jsPDF#3902

Fix font state management issue #3890 by @srikanth-s2003 in parallax/jsPDF#3891

Fix pages property to always return current array reference ( #3898 ) by @Opineppes in parallax/jsPDF#3899

Fix jsPDF + Vite compatibility issue #3851 by @tishajain25 in parallax/jsPDF#3903

Do not add pages dynamically unless autoPaging is enabled by @anmiles in parallax/jsPDF#3915

Fix: Context2d font regex too restrictive ( #3904 ) by @Opineppes in parallax/jsPDF#3906

Fix Incorrect Typing for Margins in the TableConfig Interface Definition by @Maito1794 in parallax/jsPDF#3816

New Contributors

@survivant made their first contribution in parallax/jsPDF#3897

@vishal-rathod-07 made their first contribution in parallax/jsPDF#3896

@jvdp made their first contribution in parallax/jsPDF#3902

@srikanth-s2003 made their first contribution in parallax/jsPDF#3891

@Opineppes made their first contribution in parallax/jsPDF#3899

@tishajain25 made their first contribution in parallax/jsPDF#3903

@anmiles made their first contribution in parallax/jsPDF#3915

@josephyi made their first contribution in parallax/jsPDF#3907

@Maito1794 made their first contribution in parallax/jsPDF#3816

Full Changelog: parallax/jsPDF@v3.0.3...v3.1.0

Commits

e6cf03d 4.0.0
a688c8f restrict file system access in node build (#3931)
a504e97 3.0.4
de802ab Fix Incorrect Typing for Margins in the TableConfig Interface Definition (#3816)
87162d1 chore: bump checkout, setup-node, and stale actions (#3907)
e7dc622 Fix: Context2d font regex too restrictive ( #3904 ) (#3906)
e080935 Do not add pages dynamically unless autoPaging is enabled (#3915)
c768910 add package.json exports field (#3903)
c10d90c Fix API.internal.pages not being updated when restoring a RenderTarget ( #389...
2db3d9d fix font list cache invalidation issue in context2d module (#3891)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Summary by cubic

Upgrade jsPDF to 4.0.0 to fix a Node.js path traversal vulnerability and include recent bug fixes. No app code changes; browser usage should behave the same.

Dependencies
- Bumped jspdf to 4.0.0 in apps/extensions and apps/portal.
Migration
- If you use jsPDF in Node, file system reads are blocked by default. Enable via Node’s --permission flag or set jsPDF.allowFsRead.

^{Written for commit 837fd42. Summary will update on new commits.}

Bumps [jspdf](https://github.com/parallax/jsPDF) from 3.0.3 to 4.0.0. - [Release notes](https://github.com/parallax/jsPDF/releases) - [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md) - [Commits](parallax/jsPDF@v3.0.3...v4.0.0) --- updated-dependencies: - dependency-name: jspdf dependency-version: 4.0.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>

coderabbitai · 2026-01-05T18:20:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

cla-assistant · 2026-01-05T18:20:14Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cla-assistant · 2026-01-05T18:20:19Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

cubic-dev-ai

No issues found across 3 files

greptile-apps · 2026-01-05T18:21:50Z

Greptile Summary

This PR updates jspdf from version 3.0.3 to 4.0.0, addressing a critical path traversal/local file inclusion security vulnerability (GHSA-f8cm-6447-x5h2) in the Node.js build.

Key changes:

Security fix: File system access is now restricted by default in Node.js environments
No breaking API changes detected - existing usage patterns remain compatible
Current codebase usage is browser-only (image-to-PDF conversion using new jsPDF(), addImage(), and output('blob')), so the security fix does not impact this application
Transitive dependencies updated: core-js, dompurify, esquery

Verification needed:

Run existing tests to ensure PDF generation functionality still works
Test PDF export features in both portal and extensions apps

Confidence Score: 5/5

This PR is safe to merge - it's a security patch with no breaking changes
This is a straightforward dependency security update. The version bump from 3.x to 4.0.0 includes only a security fix with no breaking API changes. The codebase uses jspdf exclusively for browser-based PDF generation (converting images/canvas to PDF), which is unaffected by the Node.js file system security changes. All usage patterns (constructor, addImage, output methods) remain compatible.
No files require special attention - verify tests pass

Important Files Changed

Filename	Overview
apps/extensions/package.json	Updated jspdf from ^3.0.2 to ^4.0.0 to fix critical security vulnerability
apps/portal/package.json	Updated jspdf from ^3.0.2 to ^4.0.0 to fix critical security vulnerability
pnpm-lock.yaml	Lock file updated with jspdf 4.0.0 and transitive dependency updates

Sequence Diagram

sequenceDiagram
    participant D as Dependabot
    participant PM as pnpm
    participant PJ as package.json
    participant L as pnpm-lock.yaml
    participant App as Application

    D->>PJ: Detect security vulnerability
    D->>PJ: Update jspdf: ^3.0.2 → ^4.0.0
    D->>PM: Trigger dependency resolution
    PM->>L: Update resolved version: 3.0.3 → 4.0.0
    PM->>L: Update transitive dependencies
    Note over L: core-js, dompurify, esquery
    App->>App: Uses jspdf for PDF generation
    Note over App: Browser-only usage<br/>Not affected by Node.js security fix

sonarqubecloud · 2026-01-05T18:25:43Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

dependabot · 2026-02-20T12:44:21Z

Superseded by #138.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 5, 2026

cubic-dev-ai Bot reviewed Jan 5, 2026

View reviewed changes

dependabot Bot closed this Feb 20, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/jspdf-4.0.0 branch February 20, 2026 12:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump jspdf from 3.0.3 to 4.0.0#131

chore(deps): bump jspdf from 3.0.3 to 4.0.0#131
dependabot[bot] wants to merge 1 commit intodevelopfrom
dependabot/npm_and_yarn/jspdf-4.0.0

dependabot Bot commented on behalf of github Jan 5, 2026 •

edited by cubic-dev-ai Bot

Loading

Uh oh!

coderabbitai Bot commented Jan 5, 2026

Review skipped

Uh oh!

cla-assistant Bot commented Jan 5, 2026

Uh oh!

cla-assistant Bot commented Jan 5, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Uh oh!

greptile-apps Bot commented Jan 5, 2026

Uh oh!

sonarqubecloud Bot commented Jan 5, 2026

Uh oh!

dependabot Bot commented on behalf of github Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Jan 5, 2026 • edited by cubic-dev-ai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v4.0.0

v3.0.4

What's Changed

New Contributors

Summary by cubic

Uh oh!

coderabbitai Bot commented Jan 5, 2026

Review skipped

Uh oh!

cla-assistant Bot commented Jan 5, 2026

Uh oh!

cla-assistant Bot commented Jan 5, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

greptile-apps Bot commented Jan 5, 2026

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Sequence Diagram

Uh oh!

sonarqubecloud Bot commented Jan 5, 2026

Quality Gate passed

Uh oh!

dependabot Bot commented on behalf of github Feb 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Jan 5, 2026 •

edited by cubic-dev-ai Bot

Loading