2.25.2

plotly · Aug 11, 2023 · e824199 · e824199
1 parent 920a50e
commit e824199
Show file tree

Hide file tree

Showing 25 changed files with 236 additions and 86 deletions.
diff --git a/dist/README.md b/dist/README.md
@@ -46,9 +46,9 @@ The main plotly.js bundles weight in at:
 | 8.1 MB | 3.4 MB | 1 MB | 8.4 MB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-2.25.1.js
+> https://cdn.plot.ly/plotly-2.25.2.js
 
-> https://cdn.plot.ly/plotly-2.25.1.min.js
+> https://cdn.plot.ly/plotly-2.25.2.min.js
 
 
 #### npm packages
@@ -91,12 +91,12 @@ The `basic` partial bundle contains trace modules `bar`, `pie` and `scatter`.
 
 | Raw size | Minified size | Minified + gzip size |
 |------|-----------------|------------------------|
-| 2.6 MB | 969.3 kB | 324.3 kB |
+| 2.6 MB | 969.5 kB | 324.4 kB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-basic-2.25.1.js
+> https://cdn.plot.ly/plotly-basic-2.25.2.js
 
-> https://cdn.plot.ly/plotly-basic-2.25.1.min.js
+> https://cdn.plot.ly/plotly-basic-2.25.2.min.js
 
 
 #### npm packages
@@ -114,12 +114,12 @@ The `cartesian` partial bundle contains trace modules `bar`, `box`, `contour`, `
 
 | Raw size | Minified size | Minified + gzip size |
 |------|-----------------|------------------------|
-| 3.3 MB | 1.2 MB | 410.4 kB |
+| 3.3 MB | 1.2 MB | 410.5 kB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-cartesian-2.25.1.js
+> https://cdn.plot.ly/plotly-cartesian-2.25.2.js
 
-> https://cdn.plot.ly/plotly-cartesian-2.25.1.min.js
+> https://cdn.plot.ly/plotly-cartesian-2.25.2.min.js
 
 
 #### npm packages
@@ -140,9 +140,9 @@ The `geo` partial bundle contains trace modules `choropleth`, `scatter` and `sca
 | 3.1 MB | 1.1 MB | 368.4 kB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-geo-2.25.1.js
+> https://cdn.plot.ly/plotly-geo-2.25.2.js
 
-> https://cdn.plot.ly/plotly-geo-2.25.1.min.js
+> https://cdn.plot.ly/plotly-geo-2.25.2.min.js
 
 
 #### npm packages
@@ -163,9 +163,9 @@ The `gl3d` partial bundle contains trace modules `cone`, `isosurface`, `mesh3d`,
 | 3.6 MB | 1.5 MB | 488.9 kB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-gl3d-2.25.1.js
+> https://cdn.plot.ly/plotly-gl3d-2.25.2.js
 
-> https://cdn.plot.ly/plotly-gl3d-2.25.1.min.js
+> https://cdn.plot.ly/plotly-gl3d-2.25.2.min.js
 
 
 #### npm packages
@@ -183,12 +183,12 @@ The `gl2d` partial bundle contains trace modules `heatmapgl`, `parcoords`, `poin
 
 | Raw size | Minified size | Minified + gzip size |
 |------|-----------------|------------------------|
-| 4.4 MB | 1.8 MB | 594.8 kB |
+| 4.4 MB | 1.8 MB | 594.9 kB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-gl2d-2.25.1.js
+> https://cdn.plot.ly/plotly-gl2d-2.25.2.js
 
-> https://cdn.plot.ly/plotly-gl2d-2.25.1.min.js
+> https://cdn.plot.ly/plotly-gl2d-2.25.2.min.js
 
 
 #### npm packages
@@ -209,9 +209,9 @@ The `mapbox` partial bundle contains trace modules `choroplethmapbox`, `densitym
 | 4.3 MB | 1.7 MB | 525.6 kB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-mapbox-2.25.1.js
+> https://cdn.plot.ly/plotly-mapbox-2.25.2.js
 
-> https://cdn.plot.ly/plotly-mapbox-2.25.1.min.js
+> https://cdn.plot.ly/plotly-mapbox-2.25.2.min.js
 
 
 #### npm packages
@@ -232,9 +232,9 @@ The `finance` partial bundle contains trace modules `bar`, `candlestick`, `funne
 | 2.8 MB | 1 MB | 353 kB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-finance-2.25.1.js
+> https://cdn.plot.ly/plotly-finance-2.25.2.js
 
-> https://cdn.plot.ly/plotly-finance-2.25.1.min.js
+> https://cdn.plot.ly/plotly-finance-2.25.2.min.js
 
 
 #### npm packages
@@ -255,9 +255,9 @@ The `strict` partial bundle contains trace modules `bar`, `barpolar`, `box`, `ca
 | 8.6 MB | 3.7 MB | 1.1 MB |
 
 #### CDN links
-> https://cdn.plot.ly/plotly-strict-2.25.1.js
+> https://cdn.plot.ly/plotly-strict-2.25.2.js
 
-> https://cdn.plot.ly/plotly-strict-2.25.1.min.js
+> https://cdn.plot.ly/plotly-strict-2.25.2.min.js
 
 
 #### npm packages

diff --git a/dist/plotly-basic.js b/dist/plotly-basic.js
@@ -1,5 +1,5 @@
 /**
-* plotly.js (basic) v2.25.1
+* plotly.js (basic) v2.25.2
 * Copyright 2012-2023, Plotly, Inc.
 * All rights reserved.
 * Licensed under the MIT license
@@ -25867,6 +25867,10 @@ lib.objectFromPath = function (path, value) {
 // the inner loop.
 var dottedPropertyRegex = /^([^\[\.]+)\.(.+)?/;
 var indexedPropertyRegex = /^([^\.]+)\[([0-9]+)\](\.)?(.+)?/;
+function notValid(prop) {
+  // guard against polluting __proto__ and other internals getters and setters
+  return prop.slice(0, 2) === '__';
+}
 lib.expandObjectPaths = function (data) {
   var match, key, prop, datum, idx, dest, trailingPath;
   if (typeof data === 'object' && !Array.isArray(data)) {
@@ -25875,11 +25879,13 @@ lib.expandObjectPaths = function (data) {
         if (match = key.match(dottedPropertyRegex)) {
           datum = data[key];
           prop = match[1];
+          if (notValid(prop)) continue;
           delete data[key];
           data[prop] = lib.extendDeepNoArrays(data[prop] || {}, lib.objectFromPath(key, lib.expandObjectPaths(datum))[prop]);
         } else if (match = key.match(indexedPropertyRegex)) {
           datum = data[key];
           prop = match[1];
+          if (notValid(prop)) continue;
           idx = parseInt(match[2]);
           delete data[key];
           data[prop] = data[prop] || [];
@@ -25905,9 +25911,12 @@ lib.expandObjectPaths = function (data) {
           } else {
             // This is the case where this property is the end of the line,
             // e.g. xaxis.range[0]
+
+            if (notValid(prop)) continue;
             data[prop][idx] = lib.expandObjectPaths(datum);
           }
         } else {
+          if (notValid(key)) continue;
           data[key] = lib.expandObjectPaths(data[key]);
         }
       }
@@ -26832,13 +26841,19 @@ module.exports = function nestedProperty(container, propStr) {
   if (isNumeric(propStr)) propStr = String(propStr);else if (typeof propStr !== 'string' || propStr.substr(propStr.length - 4) === '[-1]') {
     throw 'bad property string';
   }
-  var j = 0;
   var propParts = propStr.split('.');
   var indexed;
   var indices;
-  var i;
+  var i, j;
+  for (j = 0; j < propParts.length; j++) {
+    // guard against polluting __proto__ and other internals
+    if (String(propParts[j]).slice(0, 2) === '__') {
+      throw 'bad property string';
+    }
+  }
 
   // check for parts of the nesting hierarchy that are numbers (ie array elements)
+  j = 0;
   while (j < propParts.length) {
     // look for non-bracket chars, then any number of [##] blocks
     indexed = String(propParts[j]).match(/^([^\[\]]*)((\[\-?[0-9]*\])+)$/);
@@ -60286,7 +60301,7 @@ function getSortFunc(opts, d2c) {
 
 
 // package version injected by `npm run preprocess`
-exports.version = '2.25.1';
+exports.version = '2.25.2';
 
 /***/ }),
 

diff --git a/dist/plotly-basic.min.js b/dist/plotly-basic.min.js
diff --git a/dist/plotly-cartesian.js b/dist/plotly-cartesian.js
@@ -1,5 +1,5 @@
 /**
-* plotly.js (cartesian) v2.25.1
+* plotly.js (cartesian) v2.25.2
 * Copyright 2012-2023, Plotly, Inc.
 * All rights reserved.
 * Licensed under the MIT license
@@ -25976,6 +25976,10 @@ lib.objectFromPath = function (path, value) {
 // the inner loop.
 var dottedPropertyRegex = /^([^\[\.]+)\.(.+)?/;
 var indexedPropertyRegex = /^([^\.]+)\[([0-9]+)\](\.)?(.+)?/;
+function notValid(prop) {
+  // guard against polluting __proto__ and other internals getters and setters
+  return prop.slice(0, 2) === '__';
+}
 lib.expandObjectPaths = function (data) {
   var match, key, prop, datum, idx, dest, trailingPath;
   if (typeof data === 'object' && !Array.isArray(data)) {
@@ -25984,11 +25988,13 @@ lib.expandObjectPaths = function (data) {
         if (match = key.match(dottedPropertyRegex)) {
           datum = data[key];
           prop = match[1];
+          if (notValid(prop)) continue;
           delete data[key];
           data[prop] = lib.extendDeepNoArrays(data[prop] || {}, lib.objectFromPath(key, lib.expandObjectPaths(datum))[prop]);
         } else if (match = key.match(indexedPropertyRegex)) {
           datum = data[key];
           prop = match[1];
+          if (notValid(prop)) continue;
           idx = parseInt(match[2]);
           delete data[key];
           data[prop] = data[prop] || [];
@@ -26014,9 +26020,12 @@ lib.expandObjectPaths = function (data) {
           } else {
             // This is the case where this property is the end of the line,
             // e.g. xaxis.range[0]
+
+            if (notValid(prop)) continue;
             data[prop][idx] = lib.expandObjectPaths(datum);
           }
         } else {
+          if (notValid(key)) continue;
           data[key] = lib.expandObjectPaths(data[key]);
         }
       }
@@ -26941,13 +26950,19 @@ module.exports = function nestedProperty(container, propStr) {
   if (isNumeric(propStr)) propStr = String(propStr);else if (typeof propStr !== 'string' || propStr.substr(propStr.length - 4) === '[-1]') {
     throw 'bad property string';
   }
-  var j = 0;
   var propParts = propStr.split('.');
   var indexed;
   var indices;
-  var i;
+  var i, j;
+  for (j = 0; j < propParts.length; j++) {
+    // guard against polluting __proto__ and other internals
+    if (String(propParts[j]).slice(0, 2) === '__') {
+      throw 'bad property string';
+    }
+  }
 
   // check for parts of the nesting hierarchy that are numbers (ie array elements)
+  j = 0;
   while (j < propParts.length) {
     // look for non-bracket chars, then any number of [##] blocks
     indexed = String(propParts[j]).match(/^([^\[\]]*)((\[\-?[0-9]*\])+)$/);
@@ -70699,7 +70714,7 @@ function getSortFunc(opts, d2c) {
 
 
 // package version injected by `npm run preprocess`
-exports.version = '2.25.1';
+exports.version = '2.25.2';
 
 /***/ }),
 

diff --git a/dist/plotly-cartesian.min.js b/dist/plotly-cartesian.min.js
diff --git a/dist/plotly-finance.js b/dist/plotly-finance.js
@@ -1,5 +1,5 @@
 /**
-* plotly.js (finance) v2.25.1
+* plotly.js (finance) v2.25.2
 * Copyright 2012-2023, Plotly, Inc.
 * All rights reserved.
 * Licensed under the MIT license
@@ -25956,6 +25956,10 @@ lib.objectFromPath = function (path, value) {
 // the inner loop.
 var dottedPropertyRegex = /^([^\[\.]+)\.(.+)?/;
 var indexedPropertyRegex = /^([^\.]+)\[([0-9]+)\](\.)?(.+)?/;
+function notValid(prop) {
+  // guard against polluting __proto__ and other internals getters and setters
+  return prop.slice(0, 2) === '__';
+}
 lib.expandObjectPaths = function (data) {
   var match, key, prop, datum, idx, dest, trailingPath;
   if (typeof data === 'object' && !Array.isArray(data)) {
@@ -25964,11 +25968,13 @@ lib.expandObjectPaths = function (data) {
         if (match = key.match(dottedPropertyRegex)) {
           datum = data[key];
           prop = match[1];
+          if (notValid(prop)) continue;
           delete data[key];
           data[prop] = lib.extendDeepNoArrays(data[prop] || {}, lib.objectFromPath(key, lib.expandObjectPaths(datum))[prop]);
         } else if (match = key.match(indexedPropertyRegex)) {
           datum = data[key];
           prop = match[1];
+          if (notValid(prop)) continue;
           idx = parseInt(match[2]);
           delete data[key];
           data[prop] = data[prop] || [];
@@ -25994,9 +26000,12 @@ lib.expandObjectPaths = function (data) {
           } else {
             // This is the case where this property is the end of the line,
             // e.g. xaxis.range[0]
+
+            if (notValid(prop)) continue;
             data[prop][idx] = lib.expandObjectPaths(datum);
           }
         } else {
+          if (notValid(key)) continue;
           data[key] = lib.expandObjectPaths(data[key]);
         }
       }
@@ -26921,13 +26930,19 @@ module.exports = function nestedProperty(container, propStr) {
   if (isNumeric(propStr)) propStr = String(propStr);else if (typeof propStr !== 'string' || propStr.substr(propStr.length - 4) === '[-1]') {
     throw 'bad property string';
   }
-  var j = 0;
   var propParts = propStr.split('.');
   var indexed;
   var indices;
-  var i;
+  var i, j;
+  for (j = 0; j < propParts.length; j++) {
+    // guard against polluting __proto__ and other internals
+    if (String(propParts[j]).slice(0, 2) === '__') {
+      throw 'bad property string';
+    }
+  }
 
   // check for parts of the nesting hierarchy that are numbers (ie array elements)
+  j = 0;
   while (j < propParts.length) {
     // look for non-bracket chars, then any number of [##] blocks
     indexed = String(propParts[j]).match(/^([^\[\]]*)((\[\-?[0-9]*\])+)$/);
@@ -66593,7 +66608,7 @@ function getSortFunc(opts, d2c) {
 
 
 // package version injected by `npm run preprocess`
-exports.version = '2.25.1';
+exports.version = '2.25.2';
 
 /***/ }),
 

diff --git a/dist/plotly-finance.min.js b/dist/plotly-finance.min.js
diff --git a/dist/plotly-geo-assets.js b/dist/plotly-geo-assets.js