Bump jspdf, html2pdf.js and jspdf-autotable in /frontend/sales-agent-crew #19

dependabot · 2026-02-02T19:11:50Z

Bumps jspdf, html2pdf.js and jspdf-autotable. These dependencies needed to be updated together.
Updates jspdf from 2.5.2 to 4.1.0

Release notes

Sourced from jspdf's releases.

v4.1.0

This release fixes several security issues.

What's Changed

Upgrade optional dompurify dependency to 3.3.1 in parallax/jsPDF#3948

Fix PDF Injection in AcroForm module allows Arbitrary JavaScript Execution vulnerability

Fix Stored XMP Metadata Injection (Spoofing & Integrity Violation) vulnerability

Fix Shared State Race Condition in addJS Method vulnerability

Fix Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder vulnerability

Full Changelog: parallax/jsPDF@v4.0.0...v4.1.0

v4.0.0

This release fixes a critical path traversal/local file inclusion security vulnerability in the jsPDF Node.js build. File system access is now restricted by default and can be enabled by either using node's --permission flag or the new jsPDF.allowFsRead property.

There are no other breaking changes.

v3.0.4

This release includes a bunch of bugfixes. Thanks to all contributors!

What's Changed

[Snyk] Upgrade @babel/runtime from 7.28.3 to 7.28.4 by @MrRio in parallax/jsPDF#3895

fix: cell function now properly accepts align parameter by @vishal-rathod-07 in parallax/jsPDF#3896

Remove duplicated function "ga" from WebPDecoder.js by @jvdp in parallax/jsPDF#3902

Fix font state management issue #3890 by @srikanth-s2003 in parallax/jsPDF#3891

Fix pages property to always return current array reference ( #3898 ) by @Opineppes in parallax/jsPDF#3899

Fix jsPDF + Vite compatibility issue #3851 by @tishajain25 in parallax/jsPDF#3903

Do not add pages dynamically unless autoPaging is enabled by @anmiles in parallax/jsPDF#3915

Fix: Context2d font regex too restrictive ( #3904 ) by @Opineppes in parallax/jsPDF#3906

Fix Incorrect Typing for Margins in the TableConfig Interface Definition by @Maito1794 in parallax/jsPDF#3816

New Contributors

@survivant made their first contribution in parallax/jsPDF#3897

@vishal-rathod-07 made their first contribution in parallax/jsPDF#3896

@jvdp made their first contribution in parallax/jsPDF#3902

@srikanth-s2003 made their first contribution in parallax/jsPDF#3891

@Opineppes made their first contribution in parallax/jsPDF#3899

@tishajain25 made their first contribution in parallax/jsPDF#3903

@anmiles made their first contribution in parallax/jsPDF#3915

@josephyi made their first contribution in parallax/jsPDF#3907

@Maito1794 made their first contribution in parallax/jsPDF#3816

Full Changelog: parallax/jsPDF@v3.0.3...v3.1.0

v3.0.3

This release fixes regressions with PNG encoding that were introduced in v3.0.2.

What's Changed

Fix division by zero when calculating word spacing by @alxndr-pggm in parallax/jsPDF#3879

fix scaling of form object bounding boxes by @HackbrettXXX in parallax/jsPDF#3888

... (truncated)

Commits

0227381 4.1.0
ae4b93f Merge commit from fork
2863e5c Merge commit from fork
efe54bf Merge commit from fork
da291a5 Merge commit from fork
685e41e Bump @koa/cors and local-web-server (#3951)
8cc22a5 Bump tmp, inquirer and karma (#3945)
008b276 Bump sha.js from 2.4.11 to 2.4.12 (#3946)
ff66d52 Bump vite from 5.4.20 to 5.4.21 in /examples/vite (#3949)
bcf79f2 Bump cipher-base from 1.0.4 to 1.0.7 (#3942)
Additional commits viewable in compare view

Updates html2pdf.js from 0.10.2 to 0.14.0

Release notes

Sourced from html2pdf.js's releases.

v0.14.0

0.14.0 (2026-01-12)

Features

Sanitize text sources (#877) (988826e)

v0.13.0

0.13.0 (2026-01-07)

Features

build(deps): bump jspdf from 3.0.3 to 4.0.0 (#868) (a4c4916)

v0.12.1

0.12.1 (2025-09-17)

Bug Fixes

Include type file in npm package (#814) (3e4bba9)

v0.12.0

0.12.0 (2025-08-31)

Features

Improve node cloning using @zumer/snapdom deepClone (#792) (54c50fb)

v0.11.3

0.11.3 (2025-08-31)

Bug Fixes

Add typescript support (#795) (110897b)

v0.11.2

0.11.2 (2025-08-26)

Bug Fixes

Upgrade dependencies (#784) (c9f6095)

v0.11.1

0.11.1 (2025-08-24)

... (truncated)

Commits

29a3102 chore(release): 0.14.0 [skip ci]
988826e feat: Sanitize text sources (#877)
f6dc70f test: Add version-tester manual test utility (#876)
6fbf521 Updating package-lock.json (#875)
c3d1d9f Updating package-lock.json (#874)
308924d Updating package-lock.json (#872)
69eb04e chore(release): 0.13.0 [skip ci]
a4c4916 feat: build(deps): bump jspdf from 3.0.3 to 4.0.0 (#868)
848237a Add NPM ignore-scripts
e4f8191 Updating package-lock.json (#862)
Additional commits viewable in compare view

Updates jspdf-autotable from 3.8.4 to 5.0.7

Release notes

Sourced from jspdf-autotable's releases.

v5.0.7

Fixed npm publishing (v5.0.5 was never published)

v5.0.5

Updated to allow jsPDF 4.0 as peer dependency.

v5.0

Summary of changes in 5.0.0-5.0.2

Breaking: The plugin is no longer auto applied to jsPDF in none browser environments (see more below)

The esm build file is now chosen automatically based on your packages environment (no need to use the jspdf-autotable/es path anymore)

HookData is now exported simonbengtsson/jsPDF-AutoTable#1075

Plugin no longer applied automatically

In this release the plugin is no longer auto applied to jsPDF in none browser environments. This is a breaking change for users that for example uses this plugin in node js and call autoTable method on the jsPDF doc instance (doc.autoTable({...}).

It is now recommended to import the autoTable method and pass it the jsPDF doc instance.
import { jsPDF } from 'jspdf'
import { autoTable } from 'jspdf-autotable'
const doc = new jsPDF()
autoTable(doc, { ... })
If you want to keep calling the plugin method on the jsPDF doc instance you can also apply the plugin to it yourself using applyPlugin:
import { jsPDF } from 'jspdf'
import { applyPlugin } from 'jspdf-autotable'
// This is now required in non browser environments to use the old
// way of calling autoTable on the jspdf doc instance.
applyPlugin(jsPDF)
const doc = new jsPDF()
doc.autoTable({ ... })
v4.0.0

Mostly minor changes but bumping major version due to old deprecation removals and upgrade to jsPDF 3.0 (that removes support for internet explorer).

Jspdf 3.0 (removes support for internet explorer)

You can now import autoTable with a named import import { autoTable } from ‘jspdf-autotable’) . The previously exported autoTable type is now exported as autoTableInstanceType instead.

Removed long time deprecations

Removed support for all old options and styles that was soft removed and deprecated in v3.0

Removed old ways to get information of the last autoTable drawn: doc.previousAutoTable , doc.autoTable.previous and doc.autoTableEndPosY. Now you should use doc.lastAutoTable.

Removed Table#pageCount field. You should now use Table#pageNumber.

Removed old column/body way of calling autoTable doc.autoTable(columns, body, options). You should now use autoTable(doc, options) or doc.autoTable(options).

Removed doc.autoTableAddPageContent. You should now use jsPDF.autoTableSetDefaults({didDrawPage: () => {}})

Removed doc.autoTableAddPage(). You should now use doc.addPage().

Commits

360a0ed 5.0.7
a826a7a Update permissions
b4f5bfd Add permissions
5438c54 5.0.6
2add169 Upgrade libs
dc7c985 5.0.5
6e1e419 Remove token from workflow
3e85981 5.0.4
c8ae7d8 Fix tests
cb74b82 Upgrade workflows
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for jspdf-autotable since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [jspdf](https://github.com/parallax/jsPDF), [html2pdf.js](https://github.com/eKoopmans/html2pdf.js) and [jspdf-autotable](https://github.com/simonbengtsson/jsPDF-AutoTable). These dependencies needed to be updated together. Updates `jspdf` from 2.5.2 to 4.1.0 - [Release notes](https://github.com/parallax/jsPDF/releases) - [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md) - [Commits](parallax/jsPDF@v2.5.2...v4.1.0) Updates `html2pdf.js` from 0.10.2 to 0.14.0 - [Release notes](https://github.com/eKoopmans/html2pdf.js/releases) - [Commits](eKoopmans/html2pdf.js@v0.10.2...v0.14.0) Updates `jspdf-autotable` from 3.8.4 to 5.0.7 - [Release notes](https://github.com/simonbengtsson/jsPDF-AutoTable/releases) - [Commits](simonbengtsson/jsPDF-AutoTable@v3.8.4...v5.0.7) --- updated-dependencies: - dependency-name: jspdf dependency-version: 4.1.0 dependency-type: direct:production - dependency-name: html2pdf.js dependency-version: 0.14.0 dependency-type: direct:production - dependency-name: jspdf-autotable dependency-version: 5.0.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>

socket-security · 2026-02-02T19:12:23Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance
npm/dompurify@2.5.8 ⏵ 3.3.1	⁺¹	⁺²
npm/jspdf-autotable@3.8.4 ⏵ 5.0.7
npm/jspdf@2.5.2 ⏵ 4.1.0	⁺²	⁺⁷⁵	⁺¹	^-3
npm/html2pdf.js@0.10.2 ⏵ 0.14.0	⁺¹	⁺¹⁶	⁺¹	⁺³

View full report

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Feb 2, 2026

This was referenced Feb 2, 2026

Bump jspdf, html2pdf.js and jspdf-autotable in /frontend/sales-agent-crew #7

Closed

Bump jspdf from 2.5.2 to 4.0.0 in /frontend/sales-agent-crew #17

Closed

Bump html2pdf.js from 0.10.2 to 0.14.0 in /frontend/sales-agent-crew #18

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bump jspdf, html2pdf.js and jspdf-autotable in /frontend/sales-agent-crew #19

Bump jspdf, html2pdf.js and jspdf-autotable in /frontend/sales-agent-crew #19

Uh oh!

dependabot bot commented on behalf of github Feb 2, 2026

Uh oh!

socket-security bot commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Bump jspdf, html2pdf.js and jspdf-autotable in /frontend/sales-agent-crew #19

Are you sure you want to change the base?

Bump jspdf, html2pdf.js and jspdf-autotable in /frontend/sales-agent-crew #19

Uh oh!

Conversation

dependabot bot commented on behalf of github Feb 2, 2026

v4.1.0

What's Changed

v4.0.0

v3.0.4

What's Changed

New Contributors

v3.0.3

What's Changed

v0.14.0

0.14.0 (2026-01-12)

Features

v0.13.0

0.13.0 (2026-01-07)

Features

v0.12.1

0.12.1 (2025-09-17)

Bug Fixes

v0.12.0

0.12.0 (2025-08-31)

Features

v0.11.3

0.11.3 (2025-08-31)

Bug Fixes

v0.11.2

0.11.2 (2025-08-26)

Bug Fixes

v0.11.1

0.11.1 (2025-08-24)

v5.0.7

v5.0.5

v5.0

Plugin no longer applied automatically

v4.0.0

Uh oh!

socket-security bot commented Feb 2, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants