highcharts 11.4.8 → 11.4.9

package/highcharts-gantt.src.js

@@ -1,5 +1,5 @@
 /**
- * @license Highcharts Gantt JS v11.4.8 (2024-08-29)
+ * @license Highcharts Gantt JS v11.4.9 (2026-09-25)
  *
  * (c) 2017-2024 Lars Cabrera, Torstein Honsi, Jon Arild Nygard & Oystein Moseng
  *
@@ -62,7 +62,7 @@
              *  Constants
              *
              * */
-            Globals.SVG_NS = 'http://www.w3.org/2000/svg', Globals.product = 'Highcharts', Globals.version = '11.4.8', Globals.win = (typeof window !== 'undefined' ?
+            Globals.SVG_NS = 'http://www.w3.org/2000/svg', Globals.product = 'Highcharts', Globals.version = '11.4.9', Globals.win = (typeof window !== 'undefined' ?
                 window :
                 {}), // eslint-disable-line node/no-unsupported-features/es-builtins
             Globals.doc = Globals.win.document, Globals.svg = (Globals.doc &&
@@ -6944,6 +6944,10 @@
                 /**
                  * The URL for the credits label.
                  *
+                 * * URLs that do not start with one of the
+                 * [AST.allowedReferences](https://api.highcharts.com/class-reference/Highcharts.AST#.allowedReferences),
+                 * for example `javascript:` URLs, are ignored.
+                 *
                  * @sample {highcharts} highcharts/credits/href/
                  *         Custom URL and text
                  * @sample {highmaps} maps/credits/customized/
@@ -8218,7 +8222,7 @@
          *
          * */
         const { SVG_NS, win } = H;
-        const { attr, createElement, css, error, isFunction, isString, objectEach, splat } = U;
+        const { attr, css, error, isFunction, isString, objectEach, splat } = U;
         const { trustedTypes } = win;
         /* *
          *
@@ -8283,7 +8287,7 @@
                     if (AST.allowedAttributes.indexOf(key) === -1) {
                         valid = false;
                     }
-                    if (['background', 'dynsrc', 'href', 'lowsrc', 'src']
+                    if (['background', 'dynsrc', 'href', 'lowsrc', 'src', 'xlink:href']
                         .indexOf(key) !== -1) {
                         valid = isString(val) && AST.allowedReferences.some((ref) => val.indexOf(ref) === 0);
                     }
@@ -8459,9 +8463,10 @@
                         markup, 'text/html');
                 }
                 else {
-                    const body = createElement('div');
-                    body.innerHTML = markup;
-                    doc = { body };
+                    // Never assign untrusted markup to a live document's innerHTML.
+                    // Parse into a detached, inert document instead.
+                    doc = H.doc.implementation.createHTMLDocument('');
+                    doc.body.innerHTML = markup;
                 }
                 const appendChildNodes = (node, addTo) => {
                     const tagName = node.nodeName.toLowerCase();
@@ -12533,7 +12538,7 @@
                 this.url = this.getReferenceURL();
                 // Add description
                 const desc = this.createElement('desc').add();
-                desc.element.appendChild(doc.createTextNode('Created with Highcharts 11.4.8'));
+                desc.element.appendChild(doc.createTextNode('Created with Highcharts 11.4.9'));
                 this.defs = this.createElement('defs').add();
                 this.allowHTML = allowHTML;
                 this.forExport = forExport;
@@ -25307,11 +25312,18 @@
              */
             setNestedProperty(object, value, key) {
                 const nestedKeys = key.split('.');
+                // Reject nested keys that would allow prototype pollution
+                if (nestedKeys.some((nestedKey) => (nestedKey === '__proto__' || nestedKey === 'constructor'))) {
+                    return object;
+                }
                 nestedKeys.reduce(function (result, key, i, arr) {
                     const isLastKey = arr.length - 1 === i;
                     result[key] = (isLastKey ?
                         value :
-                        isObject(result[key], true) ?
+                        // Inherited objects are shared with everything else on
+                        // that prototype, so start a fresh one instead
+                        isObject(result[key], true) &&
+                            Object.hasOwnProperty.call(result, key) ?
                             result[key] :
                             {});
                     return result[key];
@@ -37092,6 +37104,12 @@
             addCredits(credits) {
                 const chart = this, creds = merge(true, this.options.credits, credits);
                 if (creds.enabled && !this.credits) {
+                    // Run the user-supplied URL through the allow list, so that
+                    // references like `javascript:` can't be executed from the
+                    // credits label
+                    const href = creds.href ?
+                        AST.filterUserAttributes({ href: creds.href }).href :
+                        void 0;
                     /**
                      * The chart's credits label. The label has an `update` method that
                      * allows setting new options as per the
@@ -37103,8 +37121,8 @@
                     this.credits = this.renderer.text(creds.text + (this.mapCredits || ''), 0, 0)
                         .addClass('highcharts-credits')
                         .on('click', function () {
-                        if (creds.href) {
-                            win.location.href = creds.href;
+                        if (href) {
+                            win.location.href = href;
                         }
                     })
                         .attr({

package/highcharts-more.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v11.4.8 (2024-08-29)
+ * Highcharts JS v11.4.9 (2026-09-25)
  *
  * (c) 2009-2024 Torstein Honsi
  *

package/highcharts-more.src.js

@@ -1,5 +1,5 @@
 /**
- * @license Highcharts JS v11.4.8 (2024-08-29)
+ * @license Highcharts JS v11.4.9 (2026-09-25)
  *
  * (c) 2009-2024 Torstein Honsi
  *

package/highcharts.d.ts

@@ -8508,6 +8508,9 @@ export interface CreditsOptions {
     enabled?: boolean;
     /**
      * (Highcharts, Highstock, Highmaps, Gantt) The URL for the credits label.
+     *
+     * * URLs that do not start with one of the AST.allowedReferences, for
+     * example `javascript:` URLs, are ignored.
      */
     href?: string;
     /**
@@ -9616,7 +9619,7 @@ export interface DrilldownBreadcrumbsOptions {
      * `.highcharts-breadcrumbs-buttons .highcharts-button` rule with its
      * different states.
      */
-    style?: SVGAttributes;
+    style?: CSSObject;
     /**
      * (Highcharts) Whether to use HTML to render the breadcrumbs items texts.
      */
@@ -14480,7 +14483,7 @@ export interface NavigationBreadcrumbsOptions {
      * `.highcharts-breadcrumbs-buttons .highcharts-button` rule with its
      * different states.
      */
-    style?: SVGAttributes;
+    style?: CSSObject;
     /**
      * (Highcharts) Whether to use HTML to render the breadcrumbs items texts.
      */
@@ -67300,7 +67303,7 @@ export interface PlotTreemapBreadcrumbsOptions {
      * `.highcharts-breadcrumbs-buttons .highcharts-button` rule with its
      * different states.
      */
-    style?: SVGAttributes;
+    style?: CSSObject;
     /**
      * (Highcharts) Whether to use HTML to render the breadcrumbs items texts.
      */