[Snyk] Upgrade canvas from 2.8.0 to 2.11.2

[snyk-bot]

Snyk has created this PR to upgrade canvas from 2.8.0 to 2.11.2.

ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.

---

• The recommended version is 10 versions ahead of your current version.
• The recommended version was released a month ago, on 2023-04-02.

The recommended version fixes:

Severity	Issue	PriorityScore (*)	Exploit Maturity
	Arbitrary File Write SNYK-JS-TAR-1579155	425/1000 Why? CVSS 8.5	No Known Exploit
	Arbitrary File Write SNYK-JS-TAR-1579152	425/1000 Why? CVSS 8.5	No Known Exploit
	Information Exposure SNYK-JS-SIMPLEGET-2361683	425/1000 Why? CVSS 8.5	Proof of Concept
	Regular Expression Denial of Service (ReDoS) SNYK-JS-ANSIREGEX-1583908	425/1000 Why? CVSS 8.5	Proof of Concept
	Information Exposure SNYK-JS-NODEFETCH-2342118	425/1000 Why? CVSS 8.5	No Known Exploit
	Regular Expression Denial of Service (ReDoS) SNYK-JS-MINIMATCH-3050818	425/1000 Why? CVSS 8.5	No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Release notes

Package name: canvas

• 2.11.2 - 2023-04-02
• 2.11.1 - 2023-04-02
• 2.11.0 - 2022-12-22
  

  Fixed

  • Replace triple-slash directive in types with own types to avoid polluting TS modules with globals (#1656)
• 2.10.2 - 2022-10-30
  

  Fixed

  • Fix Assertion failed: (object->InternalFieldCount() > 0), function Unwrap, file nan_object_wrap.h, line 32. (#2025)
  • textBaseline and textAlign were not saved/restored by save()/restore(). (#1936)
  • Update nan to v2.17.0 to ensure Node.js v18+ support.

  Changed

  • Improve performance and memory usage of save()/restore().
  • save()/restore() no longer have a maximum depth (previously 64 states).
• 2.10.1 - 2022-09-07
  

  Fixed

  • Fix actualBoundingBoxLeft and actualBoundingBoxRight when textAlign='center' or 'right' (#1909)
  • Fix rgba(r,g,b,0) with alpha to 0 should parse as transparent, not opaque. (#2110)
• 2.10.0 - 2022-09-04
  

  Added

  • Export pangoVersion
  • ctx.roundRect()

  Fixed

  • rgba(r,g,b) with no alpha should parse as opaque, not transparent. (#2029)
  • Typo in PngConfig.filters types. (#2072)
  • createPattern() always used "repeat" mode; now supports "repeat-x" and "repeat-y". (#2066)
  • Crashes and hangs when using non-finite values in context.arc(). (#2055)
  • Incorrect context.arc() geometry logic for full ellipses. (#1808, (#1736))
  • Added missing deregisterAllFonts to the Typescript declaration file (#2096)
  • Add User-Agent header when requesting remote images (#2099)
• 2.9.3 - 2022-06-24
  

  Fixed

  • Wrong fonts used when calling registerFont multiple times with the same family name (#2041)
• 2.9.2 - 2022-06-23
  

  Fixed

  • All exports now work when Canvas is used in ES Modules (ESM). (#2047)
  • npm rebuild will now re-fetch prebuilt binaries to avoid NODE_MODULE_VERSION mismatch errors. (#1982)
• 2.9.1 - 2022-03-19
  

  Fixed

  • Stringify CanvasGradient, CanvasPattern and ImageData like browsers do. (#1639, #1646)
  • Add missing include for toupper.
  • Throw an error instead of crashing the process if getImageData or putImageData is called on a PDF or SVG canvas (#1853)
  • Compatibility with Typescript 4.6
  • Near-perfect font matching on Linux (#1572)
  • Fix multi-byte font path support on Windows.
• 2.9.0 - 2022-01-17
  

  Changed

  • Refactor functions to classes.
  • Changed DOMPoint() constructor to check for parameter nullability.
  • Changed DOMMatrix.js to use string literals for non-special cases.
  • Remove semicolons from Dommatrix.js.
  • Update nan to v2.15.0 to ensure Node.js v14+ support.
  • Clean up inf/nan macros and slightly speed up argument checking.

  Added

  • Added deregisterAllFonts method to free up memory and reduce font conflicts.

  Fixed

  • Support Apple M1 Homebrew install that puts canvas install library files in /opt/homebrew/lib
• 2.8.0 - 2021-05-17
  

  Changed

  • Upgrade dtslint
  • Upgrade node-pre-gyp to 1.0.0. Note that if you are using special node-pre-gyp
    features like node_pre_gyp_accessKeyId, you may need to make changes to your
    installation procedure. See https://github.com/mapbox/node-pre-gyp/blob/master/CHANGELOG.md#100.
  • Add Node.js v16 to CI.
  • The C++ class method nBytes() now returns a size_t. (Because this is a C++
    method only, this is not considered a breaking change.)

  Added

  • Add support for inverse() and invertSelf() to DOMMatrix (#1648)
  • Add support for context.getTransform() (#1769)
  • Add support for context.setTransform(dommatrix) (#1769)

  Fixed

  • Fix actualBoundingBoxLeft and actualBoundingBoxRight returned by measureText to be the ink rect (#1776, fixes #1703).
  • Fix Pango logging "expect ugly output" on Windows (#1643)
  • Fix benchmark for createPNGStream (#1672)
  • Fix dangling reference in BackendOperationNotAvailable exception (#1740)
  • Fix always-false comparison warning in Canvas.cc.
  • Fix Node.js crash when throwing from an onload or onerror handler.

from canvas GitHub release notes

Commit messages

Package name: canvas

• 38e0a32 v2.11.2
• 9910243 fix not compiling on certain windows versions
• 9ecfb70 v2.11.1
• fdf709a move ctx.font string to the state struct
• 4c276e0 fix incorrect text width with newer (1.43?) Pango
• 55d39cb fix macos CI
• 9f313df Add canvas property to CanvasRenderingContext2D type
• fc160f5 v2.11.0
• 40b4382 use tailored types instead of extending DOM
• 672104c v2.10.2
• cc32159 src: shorten receiver checks
• ad18c6c src: shorten copy assignment operator decl for Point
• 2876b6e Bugfix/Node.js 18 -> Assertion failed: (object->InternalFieldCount() > 0) (#2133)
• 0e6504a remove save() limit, improve save/restore perf, fix some props
• b3e7df3 v2.10.1
• bc75c6a add line in CHANGELOG
• 9374943 Parse rgba(r,g,b,0) correctly
• 6862532 Fix actualBoundingBoxLeft/Right with center/right alignment (#2109)
• 561d933 v2.10.0
• 3fb4ed9 fix: add user agent to remote images request
• dce0fd1 Add roundRect() support
• eba1e4a Adds deregisterAllFonts to the typescript declaration file (#2096)
• 10b208e un-skip 2d.path.arc.nonfinite; now fixed
• 73d7893 fix arc geometry calculations

Compare

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.

For more information:

🧐 View latest project report

🛠 Adjust upgrade PR settings

🔕 Ignore this dependency or unsubscribe from future upgrade PRs