Conversation
update netlify deploy
Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) from 7.0.6 to 7.1.5. - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v7.1.5/packages/vite) --- updated-dependencies: - dependency-name: vite dependency-version: 7.1.5 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com>
…arn/vite-7.1.5 Bump vite from 7.0.6 to 7.1.5
|
This pull request sets up GitHub code scanning for this repository. Once the scans have completed and the checks have passed, the analysis results for this pull request branch will appear on this overview. Once you merge this pull request, the 'Security' tab will show more code scanning analysis results (for example, for the default branch). Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results. For more information about GitHub code scanning, check out the documentation. |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3389d0a4aa
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| run: npm run lint | ||
|
|
||
| - name: Run unit tests | ||
| run: npm test |
There was a problem hiding this comment.
This new npm test step executes in the existing Node 18/20 matrix, but the same commit upgrades to vitest@4.0.18, whose lockfile metadata (package-lock.json node_modules/vitest) requires Node ^20.0.0 || ^22.0.0 || >=24.0.0; the 18.x leg will therefore fail for environment reasons, making CI red even when code is correct.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 7ad2bfc. Updated CI matrix from [18.x, 20.x] to [20.x, 22.x] since vitest@4.0.18 requires Node ^20.0.0 || ^22.0.0 || >=24.0.0.
| if (isValidChartJsData(parsed)) { | ||
| return parsed as ChartJsLikeData; |
There was a problem hiding this comment.
This parser path only accepts non-map JSON when isValidChartJsData succeeds, which requires a labels array; scatter/bubble inputs in this project are datasets-only objects with {x,y[,r]} points (for example src/data/sampleData/scatter.json), so they now fail normalization and are converted to empty data in currentData, breaking scatter preview/output generation that previously worked.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 7ad2bfc. isValidChartJsData now treats labels as optional — datasets-only JSON with {x,y} points (scatter/bubble) is accepted. Labels/data length matching is only enforced when labels are present. Added test coverage for this case.
Address PR #20 review comments: - Replace regex-based HTML sanitization with proper entity encoding to fully prevent XSS (fixes GitHub Advanced Security findings for incomplete URL scheme check, multi-char sanitization, and bad regexp). - Make labels optional in isValidChartJsData so scatter/bubble datasets-only JSON ({x,y} points without labels) is accepted. - Drop Node 18.x from CI matrix since vitest@4.0.18 requires >=20. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
BaseGenerator.sanitizeForCodeGeneration still used the vulnerable regex-based approach while Generator.tsx was already fixed. Align both to use consistent HTML entity encoding for XSS prevention. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
1 participant
Summary
Key Changes
Validation
npm testnpm run lintnpm run buildnpm audit --audit-level=highAll commands pass locally on
dev.Accessibility Notes