highcharts 12.6.0 → 12.6.2

package/standalone-navigator.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/standalone-navigator
  *
  * Standalone Navigator for Highcharts.
@@ -79,7 +79,7 @@ var Globals;
      *  Constants
      *
      * */
-    Globals.SVG_NS = 'http://www.w3.org/2000/svg', Globals.product = 'Highcharts', Globals.version = '12.6.0', Globals.win = (typeof window !== 'undefined' ?
+    Globals.SVG_NS = 'http://www.w3.org/2000/svg', Globals.product = 'Highcharts', Globals.version = '12.6.2', Globals.win = (typeof window !== 'undefined' ?
         window :
         {}), // eslint-disable-line node/no-unsupported-features/es-builtins
     Globals.doc = Globals.win.document, Globals.svg = !!Globals.doc?.createElementNS?.(Globals.SVG_NS, 'svg')?.createSVGRect, Globals.pageLang = Globals.doc?.documentElement?.closest('[lang]')?.lang, Globals.userAgent = Globals.win.navigator?.userAgent || '', Globals.isChrome = Globals.win.chrome, Globals.isFirefox = Globals.userAgent.indexOf('Firefox') !== -1, Globals.isMS = /(edge|msie|trident)/i.test(Globals.userAgent) && !Globals.win.opera, Globals.isSafari = !Globals.isChrome && Globals.userAgent.indexOf('Safari') !== -1, Globals.isTouchDevice = /(Mobile|Android|Windows Phone)/.test(Globals.userAgent), Globals.isWebKit = Globals.userAgent.indexOf('AppleWebKit') !== -1, Globals.deg2rad = Math.PI * 2 / 360, Globals.marginNames = [
@@ -7169,6 +7169,10 @@ const defaultOptions = {
         /**
          * The URL for the credits label.
          *
+         * URLs that do not start with one of the
+         * [AST.allowedReferences](https://api.highcharts.com/class-reference/Highcharts.AST#.allowedReferences),
+         * for example `javascript:` URLs, are ignored.
+         *
          * @sample {highcharts} highcharts/credits/href/
          *         Custom URL and text
          * @sample {highmaps} maps/credits/customized/
@@ -8574,7 +8578,7 @@ class AST {
             if (AST.allowedAttributes.indexOf(key) === -1) {
                 valid = false;
             }
-            if (['background', 'dynsrc', 'href', 'lowsrc', 'src']
+            if (['background', 'dynsrc', 'href', 'lowsrc', 'src', 'xlink:href']
                 .indexOf(key) !== -1) {
                 valid = isString(val) && AST.allowedReferences.some((ref) => val.indexOf(ref) === 0);
             }
@@ -8757,17 +8761,25 @@ class AST {
                 markup, 'text/html');
         }
         catch {
-            // There are two cases where this fails:
-            // 1. IE9 and PhantomJS, where the DOMParser only supports parsing
-            //    XML
-            // 2. Due to a Chromium issue where chart redraws are triggered by
-            //    a `beforeprint` event (#16931),
-            //    https://issues.chromium.org/issues/40222135
+            // Due to a Chromium issue where chart redraws are triggered by a
+            // `beforeprint` event (#16931),
+            // https://issues.chromium.org/issues/40222135, the Trusted
+            // Types `createHTML` callback can throw "The provided callback
+            // is no longer runnable" while the browser is mid-print. Retry
+            // with the raw string - `DOMParser` itself is not a Trusted
+            // Types sink, so parsing it directly is safe.
+            try {
+                doc = new DOMParser().parseFromString(markup, 'text/html');
+            }
+            catch {
+                // Ignore, fall through to the inert-document fallback below.
+            }
         }
         if (!doc) {
-            const body = createElement('div');
-            body.innerHTML = markup;
-            doc = { body };
+            // Never assign untrusted markup to a live document's innerHTML.
+            // Parse into a detached, inert document instead.
+            doc = Core_Globals.doc.implementation.createHTMLDocument('');
+            doc.body.innerHTML = markup;
         }
         const appendChildNodes = (node, addTo) => {
             const tagName = node.nodeName.toLowerCase();
@@ -13304,7 +13316,7 @@ class SVGRenderer {
         this.url = this.getReferenceURL();
         // Add description
         const desc = this.createElement('desc').add();
-        desc.element.appendChild(SVGRenderer_doc.createTextNode('Created with Highcharts 12.6.0'));
+        desc.element.appendChild(SVGRenderer_doc.createTextNode('Created with Highcharts 12.6.2'));
         this.defs = this.createElement('defs').add();
         this.allowHTML = allowHTML;
         this.forExport = forExport;
@@ -26433,11 +26445,18 @@ class Point {
      */
     setNestedProperty(object, value, key) {
         const nestedKeys = key.split('.');
+        // Reject nested keys that would allow prototype pollution
+        if (nestedKeys.some((nestedKey) => (nestedKey === '__proto__' || nestedKey === 'constructor'))) {
+            return object;
+        }
         nestedKeys.reduce(function (result, key, i, arr) {
             const isLastKey = arr.length - 1 === i;
             result[key] = (isLastKey ?
                 value :
-                isObject(result[key], true) ?
+                // Inherited objects are shared with everything else on
+                // that prototype, so start a fresh one instead
+                isObject(result[key], true) &&
+                    Object.hasOwnProperty.call(result, key) ?
                     result[key] :
                     {});
             return result[key];
@@ -32865,6 +32884,13 @@ class Series {
                 for (i = 0; i < dataLength; i++) {
                     const pt = series.pointClass.prototype.applyOptions.apply({ series }, [data[i]]);
                     for (const key of dataColumnKeys) {
+                        // Assigning these would write through to
+                        // `Object.prototype` or the `Object` constructor
+                        // instead of creating a column, and thereby affect
+                        // unrelated objects on the page
+                        if (key === '__proto__' || key === 'constructor') {
+                            continue;
+                        }
                         columns[key][i] = pt[key];
                     }
                 }
@@ -38901,6 +38927,12 @@ class Chart {
     addCredits(credits) {
         const chart = this, creds = merge(true, this.options.credits, credits);
         if (creds.enabled && !this.credits) {
+            // Run the user-supplied URL through the allow list, so that
+            // references like `javascript:` can't be executed from the
+            // credits label
+            const href = creds.href ?
+                HTML_AST.filterUserAttributes({ href: creds.href }).href :
+                void 0;
             /**
              * The chart's credits label. The label has an `update` method that
              * allows setting new options as per the
@@ -38914,8 +38946,8 @@ class Chart {
                 .on('click', function (e) {
                 // Fire the event with browser redirect as default function
                 fireEvent(chart, 'creditsClick', e, () => {
-                    if (creds.href) {
-                        Chart_win.location.href = creds.href;
+                    if (href) {
+                        Chart_win.location.href = href;
                     }
                 });
             })
@@ -48012,7 +48044,7 @@ var Responsive;
 ;// ./code/es-modules/masters/highcharts.src.js
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/highcharts
  *
  * (c) 2009-2026 Highsoft AS
@@ -52180,7 +52212,7 @@ class StandaloneNavigator {
 ;// ./code/es-modules/masters/modules/navigator.src.js
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/modules/navigator
  * @requires highcharts
  *

package/themes/adaptive.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/adaptive
  * @requires highcharts
  *

package/themes/adaptive.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/adaptive
  * @requires highcharts
  *

package/themes/avocado.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/avocado
  * @requires highcharts
  *

package/themes/avocado.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/avocado
  * @requires highcharts
  *

package/themes/brand-dark.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/brand-dark
  * @requires highcharts
  *

package/themes/brand-dark.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/brand-dark
  * @requires highcharts
  *

package/themes/brand-light.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/brand-light
  * @requires highcharts
  *

package/themes/brand-light.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/brand-light
  * @requires highcharts
  *

package/themes/dark-blue.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/dark-blue
  * @requires highcharts
  *

package/themes/dark-blue.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/dark-blue
  * @requires highcharts
  *

package/themes/dark-green.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/dark-green
  * @requires highcharts
  *

package/themes/dark-green.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/dark-green
  * @requires highcharts
  *

package/themes/dark-unica.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/dark-unica
  * @requires highcharts
  *

package/themes/dark-unica.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/dark-unica
  * @requires highcharts
  *

package/themes/gray.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/gray
  * @requires highcharts
  *

package/themes/gray.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/gray
  * @requires highcharts
  *

package/themes/grid-light.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/grid-light
  * @requires highcharts
  *

package/themes/grid-light.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/grid-light
  * @requires highcharts
  *

package/themes/grid.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/grid
  * @requires highcharts
  *

package/themes/grid.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/grid
  * @requires highcharts
  *

package/themes/high-contrast-dark.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/high-contrast-dark
  * @requires highcharts
  *

package/themes/high-contrast-dark.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/high-contrast-dark
  * @requires highcharts
  *

package/themes/high-contrast-light.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/high-contrast-light
  * @requires highcharts
  *

package/themes/high-contrast-light.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/high-contrast-light
  * @requires highcharts
  *

package/themes/sand-signika.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/sand-signika
  * @requires highcharts
  *

package/themes/sand-signika.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/sand-signika
  * @requires highcharts
  *

package/themes/skies.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/skies
  * @requires highcharts
  *

package/themes/skies.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/skies
  * @requires highcharts
  *

package/themes/sunset.js

@@ -1,5 +1,5 @@
 !/**
- * Highcharts JS v12.6.0 (2026-04-13)
+ * Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/sunset
  * @requires highcharts
  *

package/themes/sunset.src.js

@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: LicenseRef-Highcharts
 /**
- * @license Highcharts JS v12.6.0 (2026-04-13)
+ * @license Highcharts JS v12.6.2 (2026-09-21)
  * @module highcharts/themes/sunset
  * @requires highcharts
  *

package/.github/workflows/codeql.yml

@@ -1,99 +0,0 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
-name: "CodeQL Advanced"
-
-on:
-  push:
-    branches: [ "master" ]
-  pull_request:
-    branches: [ "master" ]
-  schedule:
-    - cron: '43 4 * * 6'
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    # Runner size impacts CodeQL analysis time. To learn more, please see:
-    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
-    #   - https://gh.io/supported-runners-and-hardware-resources
-    #   - https://gh.io/using-larger-runners (GitHub.com only)
-    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
-    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
-    permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - language: javascript-typescript
-          build-mode: none
-        # CodeQL supports the following values keywords for 'language': 'actions', 'c-cpp', 'csharp', 'go', 'java-kotlin', 'javascript-typescript', 'python', 'ruby', 'rust', 'swift'
-        # Use `c-cpp` to analyze code written in C, C++ or both
-        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
-        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
-        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
-        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
-        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
-        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@v4
-
-    # Add any setup steps before running the `github/codeql-action/init` action.
-    # This includes steps like installing compilers or runtimes (`actions/setup-node`
-    # or others). This is typically only required for manual builds.
-    # - name: Setup runtime (example)
-    #   uses: actions/setup-example@v1
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-
-        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
-        # queries: security-extended,security-and-quality
-
-    # If the analyze step fails for one of the languages you are analyzing with
-    # "We were unable to automatically build your code", modify the matrix above
-    # to set the build mode to "manual" for that language. Then modify this step
-    # to build your code.
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-    - name: Run manual build steps
-      if: matrix.build-mode == 'manual'
-      shell: bash
-      run: |
-        echo 'If you are using a "manual" build mode for one or more of the' \
-          'languages you are analyzing, replace this with the commands to build' \
-          'your code, for example:'
-        echo '  make bootstrap'
-        echo '  make release'
-        exit 1
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
-      with:
-        category: "/language:${{matrix.language}}"