Upgrade jspdf to clear ten critical advisories - #117
Merged
Merged
Conversation
jspdf 3.0.1 carries ten critical advisories, among them arbitrary JavaScript execution through PDF injection in the AcroForm and addJS paths, local file inclusion, and denial of service via malformed GIF and BMP dimensions. npm audit --omit=dev goes from ten of them to none. The major bump is safe here: jspdf-autotable 5.0.8 declares a peer range of ^2 || ^3 || ^4, and tableExport.ts only uses new jsPDF(), autoTable(doc, ...) and doc.save(), which are unchanged in 4.x.
|
dcruzb
added a commit
that referenced
this pull request
Sep 16, 2026
Upgrade jspdf to clear ten critical advisories
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
jspdf@3.0.1carries ten critical advisories, including arbitrary JavaScript execution through PDF injection (AcroForm andaddJS), local file inclusion / path traversal, and denial of service via malformed GIF and BMP dimensions.It is a runtime dependency, so it reaches every consumer of the package. This blocks the 2.0.0 release:
npm auditwould flag the new major on day one.Why the major bump is safe
jspdf-autotable@5.0.8declares a peer range of^2 || ^3 || ^4, so there is no peer conflict.src/lib/tableExport.tsis the only consumer and uses justnew jsPDF(),autoTable(doc, { head, body })anddoc.save(). None of them changed in 4.x.Verified locally
tscclean, 14 tests passing,build:libandbuild-storybookboth succeeding withjspdf@4.2.1installed.Not in this PR
The 22 advisories left in the full
npm auditare all in the dev toolchain (vitest, vite and their trees) and never reach consumers, which is why the CI audit job scopes itself to--omit=dev.Also unchanged:
jspdf,jspdf-autotable,html-to-imageand@tanstack/react-tableare declared as runtimedependencies, butdistreferences none of them —TableandtableExportare used only by stories and are not exported. While that holds, moving the four todevDependencieswould stop every consumer from installing them. That touches how the table feature is meant to ship, so it is left to whoever owns it.