highcharts 11.4.7 → 11.4.9

package/es-modules/Core/Defaults.js

@@ -2104,8 +2104,9 @@ const defaultOptions = {
          * @apioption tooltip.positioner
          */
         /**
-         * Split the tooltip into one label per series, with the header close
-         * to the axis. This is recommended over [shared](#tooltip.shared)
+         * Shows tooltip for all points with the same X value. Splits the
+         * tooltip into one label per series, with the header close to the axis.
+         * This is recommended over [shared](#tooltip.shared)
          * tooltips for charts with multiple line series, generally making them
          * easier to read. This option takes precedence over `tooltip.shared`.
          *
@@ -2343,11 +2344,12 @@ const defaultOptions = {
          */
         shape: 'callout',
         /**
-         * When the tooltip is shared, the entire plot area will capture mouse
-         * movement or touch events. Tooltip texts for series types with ordered
-         * data (not pie, scatter, flags etc) will be shown in a single bubble.
-         * This is recommended for single series charts and for tablet/mobile
-         * optimized charts.
+         * Shows information in the tooltip for all points with the same X
+         * value. When the tooltip is shared, the entire plot area will capture
+         * mouse movement or touch events. Tooltip texts for series types with
+         * ordered data (not pie, scatter, flags etc) will be shown in a single
+         * bubble. This is recommended for single series charts and for
+         * tablet/mobile optimized charts.
          *
          * See also [tooltip.split](#tooltip.split), that is better suited for
          * charts with many series, especially line-type series. The
@@ -2598,6 +2600,10 @@ const defaultOptions = {
         /**
          * The URL for the credits label.
          *
+         * * URLs that do not start with one of the
+         * [AST.allowedReferences](https://api.highcharts.com/class-reference/Highcharts.AST#.allowedReferences),
+         * for example `javascript:` URLs, are ignored.
+         *
          * @sample {highcharts} highcharts/credits/href/
          *         Custom URL and text
          * @sample {highmaps} maps/credits/customized/

package/es-modules/Core/Globals.js

@@ -24,7 +24,7 @@ var Globals;
      *  Constants
      *
      * */
-    Globals.SVG_NS = 'http://www.w3.org/2000/svg', Globals.product = 'Highcharts', Globals.version = '@product.version@', Globals.win = (typeof window !== 'undefined' ?
+    Globals.SVG_NS = 'http://www.w3.org/2000/svg', Globals.product = 'Highcharts', Globals.version = '11.4.9', Globals.win = (typeof window !== 'undefined' ?
         window :
         {}), // eslint-disable-line node/no-unsupported-features/es-builtins
     Globals.doc = Globals.win.document, Globals.svg = (Globals.doc &&

package/es-modules/Core/Legend/LegendSymbol.js

@@ -45,7 +45,7 @@ var LegendSymbol;
      * The legend object.
      */
     function lineMarker(legend, item, hasArea) {
-        const legendItem = this.legendItem = this.legendItem || {}, { chart, options } = this, { baseline = 0, symbolWidth, symbolHeight } = legend, symbol = this.symbol || 'circle', generalRadius = symbolHeight / 2, renderer = chart.renderer, legendItemGroup = legendItem.group, verticalCenter = baseline - Math.round(symbolHeight *
+        const legendItem = this.legendItem = this.legendItem || {}, { chart, options } = this, { baseline = 0, symbolWidth, symbolHeight } = legend, symbol = this.symbol || 'circle', generalRadius = symbolHeight / 2, renderer = chart.renderer, legendItemGroup = legendItem.group, verticalCenter = baseline - Math.round((legend.fontMetrics?.b || symbolHeight) *
             // Render line and marker slightly higher to make room for the
             // area
             (hasArea ? 0.4 : 0.3)), attr = {};

package/es-modules/Core/Renderer/HTML/AST.js

@@ -11,7 +11,7 @@
 import H from '../../Globals.js';
 const { SVG_NS, win } = H;
 import U from '../../Utilities.js';
-const { attr, createElement, css, error, isFunction, isString, objectEach, splat } = U;
+const { attr, css, error, isFunction, isString, objectEach, splat } = U;
 const { trustedTypes } = win;
 /* *
  *
@@ -76,7 +76,7 @@ class AST {
             if (AST.allowedAttributes.indexOf(key) === -1) {
                 valid = false;
             }
-            if (['background', 'dynsrc', 'href', 'lowsrc', 'src']
+            if (['background', 'dynsrc', 'href', 'lowsrc', 'src', 'xlink:href']
                 .indexOf(key) !== -1) {
                 valid = isString(val) && AST.allowedReferences.some((ref) => val.indexOf(ref) === 0);
             }
@@ -252,9 +252,10 @@ class AST {
                 markup, 'text/html');
         }
         else {
-            const body = createElement('div');
-            body.innerHTML = markup;
-            doc = { body };
+            // Never assign untrusted markup to a live document's innerHTML.
+            // Parse into a detached, inert document instead.
+            doc = H.doc.implementation.createHTMLDocument('');
+            doc.body.innerHTML = markup;
         }
         const appendChildNodes = (node, addTo) => {
             const tagName = node.nodeName.toLowerCase();

package/es-modules/Core/Renderer/SVG/SVGRenderer.js

@@ -169,7 +169,7 @@ class SVGRenderer {
         this.url = this.getReferenceURL();
         // Add description
         const desc = this.createElement('desc').add();
-        desc.element.appendChild(doc.createTextNode('Created with @product.name@ @product.version@'));
+        desc.element.appendChild(doc.createTextNode('Created with Highcharts 11.4.9'));
         this.defs = this.createElement('defs').add();
         this.allowHTML = allowHTML;
         this.forExport = forExport;
@@ -1134,6 +1134,7 @@ class SVGRenderer {
                 });
             }
             img.isImg = true;
+            img.symbolUrl = symbol;
             if (defined(img.imgwidth) && defined(img.imgheight)) {
                 centerImage(img);
             }

package/es-modules/Core/Series/DataLabel.js

@@ -387,6 +387,15 @@ var DataLabel;
                                 // read text bounding box
                                 dataLabel.css(style).shadow(labelOptions.shadow);
                             }
+                            else if (style.width) {
+                                // In styled mode with a width property set,
+                                // the width should be applied to the
+                                // dataLabel. (#20499)
+                                dataLabel.css({
+                                    width: style.width,
+                                    textOverflow: style.textOverflow
+                                });
+                            }
                             fireEvent(dataLabel, 'beforeAddingDataLabel', { labelOptions, point });
                             if (!dataLabel.added) {
                                 dataLabel.add(dataLabelsGroup);

package/es-modules/Core/Series/Point.js

@@ -659,11 +659,18 @@ class Point {
      */
     setNestedProperty(object, value, key) {
         const nestedKeys = key.split('.');
+        // Reject nested keys that would allow prototype pollution
+        if (nestedKeys.some((nestedKey) => (nestedKey === '__proto__' || nestedKey === 'constructor'))) {
+            return object;
+        }
         nestedKeys.reduce(function (result, key, i, arr) {
             const isLastKey = arr.length - 1 === i;
             result[key] = (isLastKey ?
                 value :
-                isObject(result[key], true) ?
+                // Inherited objects are shared with everything else on
+                // that prototype, so start a fresh one instead
+                isObject(result[key], true) &&
+                    Object.hasOwnProperty.call(result, key) ?
                     result[key] :
                     {});
             return result[key];

package/es-modules/Core/Series/Series.js

@@ -1383,7 +1383,7 @@ class Series {
          * @private
          */
         function limitedRange(val) {
-            return clamp(val, -1e5, 1e5);
+            return clamp(val, -1e9, 1e9);
         }
         // Translate each point
         for (i = 0; i < dataLength; i++) {

package/es-modules/Core/Tooltip.js

@@ -729,6 +729,15 @@ class Tooltip {
                             text.join('') :
                             text
                     });
+                    // When the length of the label has increased, immediately
+                    // update the x position to prevent tooltip from flowing
+                    // outside the viewport during animation (#21371)
+                    if (this.outside) {
+                        label.attr({
+                            x: clamp(label.x || 0, 0, this.getPlayingField().width -
+                                (label.width || 0))
+                        });
+                    }
                     if (!styledMode) {
                         label.attr({
                             stroke: (options.borderColor ||

package/es-modules/Extensions/Annotations/Annotation.js

@@ -76,6 +76,8 @@ function getLabelsAndShapesOptions(baseOptions, newOptions) {
  * shapes. Created items are positioned on the chart either by linking them to
  * existing points or created mock points
  *
+ * @requires modules/annotations
+ *
  * @class
  * @name Highcharts.Annotation
  *
@@ -561,6 +563,8 @@ Annotation.MockPoint = MockPoint;
  * An object uses for mapping between a shape type and a constructor.
  * To add a new shape type extend this object with type name as a key
  * and a constructor as its value.
+ *
+ * @private
  */
 Annotation.shapesMap = {
     'rect': ControllableRect,

package/es-modules/Extensions/Annotations/NavigationBindingsDefaults.js

@@ -319,7 +319,7 @@ const navigation = {
      * from a different server.
      *
      * @type      {string}
-     * @default   https://code.highcharts.com/@product.version@/gfx/stock-icons/
+     * @default   https://code.highcharts.com/11.4.9/gfx/stock-icons/
      * @since     7.1.3
      * @apioption navigation.iconsURL
      */

package/es-modules/Extensions/Annotations/Popup/PopupComposition.js

@@ -47,7 +47,7 @@ function onNavigationBindingsShowPopup(config) {
         this.popup = new Popup(this.chart.container, (this.chart.options.navigation.iconsURL ||
             (this.chart.options.stockTools &&
                 this.chart.options.stockTools.gui.iconsURL) ||
-            'https://code.highcharts.com/@product.version@/gfx/stock-icons/'), this.chart);
+            'https://code.highcharts.com/11.4.9/gfx/stock-icons/'), this.chart);
     }
     this.popup.showForm(config.formType, this.chart, config.options, config.onSubmit);
 }

package/es-modules/Extensions/Boost/BoostSeries.js

@@ -447,6 +447,8 @@ function exitBoost(series) {
             boost.clear();
         }
     }
+    // #21106, clean up boost clipping on the series groups.
+    (chart.seriesGroup || series.group)?.clip();
 }
 /**
  * @private

package/es-modules/Extensions/Breadcrumbs/Breadcrumbs.js

@@ -348,7 +348,12 @@ class Breadcrumbs {
      *        Returns the SVG button
      */
     renderButton(breadcrumb, posX, posY) {
-        const breadcrumbs = this, chart = this.chart, breadcrumbsOptions = breadcrumbs.options, buttonTheme = merge(breadcrumbsOptions.buttonTheme);
+        const breadcrumbs = this, chart = this.chart, breadcrumbsOptions = breadcrumbs.options, 
+        // The `style` option is CSS for the button text, so it belongs in
+        // the theme's `style` rather than being applied afterwards. A
+        // later `setState` re-applies the normal state style, which would
+        // otherwise wipe it (#25357).
+        buttonTheme = merge(breadcrumbsOptions.buttonTheme, chart.styledMode ? void 0 : { style: breadcrumbsOptions.style });
         const button = chart.renderer
             .button(breadcrumbs.getButtonText(breadcrumb), posX, posY, function (e) {
             // Extract events from button object and call
@@ -373,9 +378,6 @@ class Breadcrumbs {
         }, buttonTheme)
             .addClass('highcharts-breadcrumbs-button')
             .add(breadcrumbs.group);
-        if (!chart.styledMode) {
-            button.attr(breadcrumbsOptions.style);
-        }
         return button;
     }
     /**

package/es-modules/Extensions/Breadcrumbs/BreadcrumbsDefaults.js

@@ -236,7 +236,7 @@ const options = {
      * `.highcharts-breadcrumbs-buttons .highcharts-button` rule with its
      * different states.
      *
-     * @type  {Highcharts.SVGAttributes}
+     * @type  {Highcharts.CSSObject}
      * @since 10.0.0
      */
     style: {},