Skip to content

build(deps): bump jspdf from 4.1.0 to 4.2.1#47

Open
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/jspdf-4.2.1
Open

build(deps): bump jspdf from 4.1.0 to 4.2.1#47
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/npm_and_yarn/jspdf-4.2.1

Conversation

@dependabot
Copy link
Contributor

@dependabot dependabot bot commented on behalf of github Mar 17, 2026

Bumps jspdf from 4.1.0 to 4.2.1.

Release notes

Sourced from jspdf's releases.

v4.2.1

This release fixes two security issues.

What's Changed

Full Changelog: parallax/jsPDF@v4.2.0...v4.2.1

v4.2.0

This release fixes three security issues.

What's Changed

New Contributors

Full Changelog: parallax/jsPDF@v4.1.0...v4.2.0

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [jspdf](https://github.com/parallax/jsPDF) from 4.1.0 to 4.2.1.
- [Release notes](https://github.com/parallax/jsPDF/releases)
- [Changelog](https://github.com/parallax/jsPDF/blob/master/RELEASE.md)
- [Commits](parallax/jsPDF@v4.1.0...v4.2.1)

---
updated-dependencies:
- dependency-name: jspdf
  dependency-version: 4.2.1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 17, 2026
@vercel
Copy link
Contributor

vercel bot commented Mar 17, 2026

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
transcriptr Ready Ready Preview, Comment Mar 17, 2026 6:44pm

Request Review

@sonarqubecloud
Copy link

@kilo-code-bot
Copy link

kilo-code-bot bot commented Mar 17, 2026

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

This is a security update from Dependabot that bumps jspdf from 4.1.0 to 4.2.1.

Security Fixes (5 vulnerabilities addressed)

CVE Type Description
HTML Injection Fixed HTML injection in output methods
PDF Object Injection Fixed via free text annotation color
PDF Injection Fixed in AcroForm module (RadioButton children)
DoS Fixed Client-Side/Server-Side Denial of Service via malicious GIF dimensions
PDF Object Injection Fixed via unsanitized input in addJS method

Code Compatibility

  • API usage in src/lib/pdf-generation.ts is compatible
  • API usage in src/components/transcription/TranscriptionResult.tsx is compatible
  • No breaking changes between versions 4.1.0 and 4.2.1
  • SonarQube Quality Gate passed
  • Vercel preview deployment successful

Files Reviewed (2 files)

  • package.json - Dependency version bump
  • package-lock.json - Lockfile updates

Action: Safe to merge. This addresses multiple security vulnerabilities with no code changes required.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants