Update dependency vega to v5.17.3 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
vega	5.8.1 -> 5.17.3

GitHub Vulnerability Alerts

CVE-2020-26296

Vega is a visualization grammar, a declarative format for creating, saving, and sharing interactive visualization designs. Vega in an npm package.
In Vega before version 5.17.3 there is an XSS vulnerability in Vega expressions. Through a specially crafted Vega expression, an attacker could
execute arbitrary javascript on a victim's machine.

This is fixed in version 5.17.3

---

Release Notes

vega/vega (vega)

v5.17.3

Compare Source

Changes from v5.17.2:

vega-expression

• Remove unsafe replace function. (#​3027)

vega-functions

• Add replace function with input type check. (#​3027)

vega-parser

• Update dependencies.

vega-view

• Update dependencies.

v5.17.2

Compare Source

Changes from v5.17.1:

vega-expression

• Remove unsafe sequence functions. (#​3027)

vega-functions

• Add sequence functions with input type checks. (#​3027)

vega-parser

• Update dependencies.

vega-schema

• Fix JSON schema bug (#​3025, thanks @​domoritz!)

vega-selections

• Update dependencies.

vega-view

• Update dependencies.

v5.17.1

Compare Source

Changes from v5.17.0:

vega-geo

• Fix contour quantize bug. (#​2994)

vega-expression

• Fix XSS vulnerability in expression parser and code generator. (#​3018)

vega-typings

• Remove incorrect comment for Interpolate type.

v5.17.0

Compare Source

Changes from v5.16.1:

vega-canvas

• Fix browser index route for ES modules. (#​2907)

vega-loader

• Add iterable support to JSON loader. Iterable inputs are expanded to arrays, then ingested.
• Fix browser index route for ES modules. (#​2907)

vega-util

• Add isIterable utility.

v5.16.1

Compare Source

Changes from v5.16.0:

monorepo

• Fix rollup config to use umd rather than iife bundles. (#​2896)

v5.16.0

Compare Source

Notable Changes

• The new label transform automatically positions labels without overlapping other marks. (Thanks @​chanwutk!)
• Completes the transition to using vega-datasets 2.0+, including swapping out the Iris dataset for a more adorable Penguins dataset. 🐧
• Major update of build system to use a centralized rollup configuration. (Thanks @​domoritz!)

Changelog

Changes from v5.15.0:

docs

• Add Calendar View example.
• Add Labeled Scatter Plot example.
• Update Box Plot example to use penguins data.
• Update Violin Plot example to use penguins data.

monorepo

• Complete transition to vega-datasets 2.0.
• Use centralized rollup config. (thanks @​domoritz!)

vega

• Use centralized rollup config. (thanks @​domoritz!)
• Update and extend test specifications.

vega-canvas

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-crossfilter

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-dataflow

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-encode

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-event-selector

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-expression

• Use forbidden / allowed, remove blacklist / whitelist (Breaking change)
• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-functions

• Use centralized rollup config. (thanks @​domoritz!)
• Use argument spread syntax. (thanks @​lgrammel!)

vega-force

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-format

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-geo

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-hierarchy

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-interpreter

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-label

• 1.0.0 release, now integrated into Vega! (thanks @​chanwutk!)
• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-loader

• Fix JSON copy option logic. (#​2890, thanks @​cytomich!)
• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-parser

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-projection

• Use centralized rollup config. (thanks @​domoritz!)

vega-projection-extended

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-regression

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-runtime

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)
• Use argument spread syntax. (thanks @​lgrammel!)

vega-scale

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-scenegraph

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)
• Use argument spread syntax. (thanks @​lgrammel!)

vega-schema

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-selections

• Use centralized rollup config. (thanks @​domoritz!)
• Use argument spread syntax. (thanks @​lgrammel!)

vega-statistics

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-time

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-transforms

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-typings

• Update view typings. (#​2846, thanks @​domoritz!)
• Fix image mark config. (#​2871, thanks @​domoritz!)

vega-util

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-view-transforms

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-view

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

vega-voronoi

• Use centralized rollup config. (thanks @​domoritz!)

vega-wordcloud

• Fix use of var, prefer const and let. (thanks @​lgrammel!)
• Use centralized rollup config. (thanks @​domoritz!)

v5.15.0

Compare Source

Changes from v5.14.0:

monorepo

• Update dependencies, including use of D3 v6 packages.
• Refactor all packages for JavaScript modernization. (thanks @​domoritz & @​lgrammel!)

vega

• Update vega-core build to use D3 v6.

vega-scale

• Add turbo and cividis color palettes. (thanks @​mcnuttandrew!)

v5.14.0

Compare Source

Notable Changes

• Update SVG rendering to produce fully compliant XML. (#​2672)
• Major refactoring of the Vega code to be more lean and modern. The main changes are:
  • Use shorthand property method syntax (e.g., rather than assignment to prototype objects).
  • Use arrow functions rather than function declarations where appropriate.
  • Prefer use of let and const to var.
• Upgrade the documentation examples to use vega-datasets 2.0+, including swapping out the Iris dataset for a more adorable Penguins dataset. 🐧
• Various bug fixes, documented below.

Changelog

Changes from v5.13.0:

vega-cli

• Update SVG test output.

vega-canvas

• Update to use leaner syntax.

vega-crossfilter

• Update to use leaner syntax.

vega-dataflow

• Fix EventStream to support detach method. (#​2753)
• Fix Pulse addAll to clear rem set when applicable. This prevents tuple removal from being invoked on newly instantiated operators that never observed those tuples in the first place. (#​2605)
• Update to use leaner syntax.

vega-encode

• Update to use leaner syntax.

vega-event-selector

• Update to use leaner syntax.

vega-expression

• Update to use leaner syntax.

vega-force

• Update to use leaner syntax.

vega-format

• Update to use leaner syntax.

vega-functions

• Update to use leaner syntax.

vega-geo

• Update to use leaner syntax.

vega-hierarchy

• Update to use leaner syntax.

vega-label

• Update to use leaner syntax.

vega-loader

• Update to use leaner syntax.

vega-parser

• Fix production rule support for guides. (#​2754)
• Update to use leaner syntax.

vega-projection

• Update to use leaner syntax.

vega-regression

• Update to use leaner syntax.

vega-scale

• Update to use leaner syntax.

vega-scenegraph

• Add markup and serializeXML utilities for SVG string output. Ensure proper XML output. (#​2672)
• Fix leaky SVG scaleX/Y transforms on non-path marks. (#​2738)
• Fix bounds calculation for rotated paths. (#​2780)
• Fix canvas picking for clipped groups with corner radius and no fill. (#​2797)
• Fix SVG path parsing: support concatenated decimals and implicit lineTo commands. (#​2803)
• Update tests, add xmllint checks to test conformance of SVG output.
• Update to use leaner syntax.
• Internal Breaking Change: Update SVGStringRenderer class methods to use markup utility.
• Internal Breaking Change: Drop openTag, closeTag utilities.

vega-statistics

• Update to use leaner syntax.

vega-time

• Update to use leaner syntax.

vega-transforms

• Update to use leaner syntax.

vega-view-transforms

• Update to use leaner syntax.

vega-view

• Update to use leaner syntax.

vega-util

• Add members argument to inherits utility.
• Add ascending comparator utility.
• Update to use leaner syntax.

vega-voronoi

• Update to use leaner syntax.

vega-wordcloud

• Update to use leaner syntax.

v5.13.0

Compare Source

Notable Changes

• Improved Streaming Performance.

  For performance, Vega caches a lot of internal data structures, including calculated tuples, scenegraph items, and SVG DOM nodes. Previously, nested scopes (such as those created for facetted data) that result in vega-runtime subcontexts were never cleaned. If no external View API calls are made, this is fine, and actually improves performance for interaction-driven dynamic filtering. However, when providing streaming data to Vega through the View API, uncleaned caches and subcontexts can result in substantial memory leaks that also eventually degrade performance.

  This version adds mechanisms for clearing caches and detaching subflows to support streaming data within nested specifications. When input data is removed via a View API call or via signal-valued URL, Vega will now by default trigger garbage collection to reclaim resources. This behavior can be disabled by calling clean(false) on a constructed ChangeSet passed to the View API.

• Improved Cursor Performance.

  Previously Vega updated the cursor style on the HTML document body. This persists cursor settings even during interactions (such as drags) that may leave the Vega View component. However, it also can result in large performance penalties in Chrome, which re-evaluates CSS styles in response. This version changes the default behavior to set the cursor locally on the Vega View component. If a global cursor is desired, the boolean config property events.globalCursor can be set true or the View method globalCursor can be invoked to change the setting at runtime.

• Optional Expression Interpreter.

  This release adds interpreter support for Vega expressions that is Content Security Policy (CSP) compliant. By default, the Vega parser performs code generation for parsed Vega expressions, and the Vega runtime uses the Function constructor to create JavaScript functions from the generated code. Although the Vega parser includes its own security checks, the runtime generation of functions from source code nevertheless violates security policies designed to prevent cross-site scripting.

  This release provides an interpreter plug-in (the new vega-interpreter package) that evaluates expressions by traversing an Abstract Syntax Tree (AST) for an expression and performing each operation in turn. Use of the interpreter enables compliance with CSP, but can incur a performance penalty. In tests of initial parse and dataflow evaluation times, the interpreter is on average ~10% slower. Interactive updates may incur higher penalties, as they are often more expression-heavy and amortize the one-time cost of Function constructor parsing.

Changelog

Changes from v5.12.3:

vega

• Update stream.html and stream-nested.html performance test pages.

vega-dataflow

• Add detach method to Operator to remove adjacent edges (listeners) from the dataflow graph.
• Add clean setter to ChangeSet, set to true by default if any tuples are removed.
• Add clean getter/setter to Pulse, propagate value to forked pulses if they share a data source.
• Update logging calls during Dataflow evaluation.

vega-encode

• Update DataJoin transform to clean internal map when pulse.clean() is true.
• Update Scale to include domainMid as an extrema if it exceeds the domain min or max. (#​2656)

vega-functions

• Fix scale function to not special case undefined input. This ensures identical semantics with the internal _scale helper function used by code-generated encoders.

vega-geo

• Update d3-geo dependency.

vega-interpreter

• Add new vega-interpreter package.

vega-projection

• Update d3-geo dependency.

vega-projection-extended

• Update vega-projection dependency.

vega-runtime

• Add runtime detach method to remove subcontexts. Export as detachSubflow on the head operator of a generated subflow.
• Add pluggable expression evaluators.

vega-statistics

• Fix numbers utility to exclude empty string.

vega-transforms

• Update Aggregate transform to clean internal map when pulse.clean() is true.
• Update Facet, PreFacet, and Subflow transforms to prune subflows in response to pulse.clean().
• Update Load transform to set pulse.clean(true) when removing loaded data.
• Fix Bin and Extent to treat empty string as a missing value. (thanks @​domoritz!)
• Fix aggregate ops to treat empty string as a missing value.

vega-typings

• Add eventConfig.globalCursor to config typings.
• Add dataflow logger to typings.
• Add parse options to typings.

vega-util

• Refactor code for fastmap and visitArray utilities.

vega-view

• Add View constructor option expr to pass in a custom expression evaluator.
• Add globalCursor method and event configuration.
• Update to make the Vega view container the default cursor target.

v5.12.3

Compare Source

Notable Changes

The previous Vega v5.12.0 release introduced changes to how SVG was generated, including the addition of an internal stylesheet. However, this leads to integration issues with downstream tools (including at least one popular SVG optimizer) that do not support stylesheet parsing. In addition, local performance tests indicate faster rendering in Chrome when using presentation attributes instead of CSS styling. This version (v5.12.3) now changes the SVG output to favor presentation attributes (fill="blue") over CSS style (style="fill: blue;").

CSS styles have been removed in all but one case: the use of image-rendering for non-smoothed images, where browser differences require multiple style definitions to appease both Chrome and Firefox, something we can't express with presentation attributes alone. If and when Firefox properly supports image-rendering: pixelated we can consider dropping this last use of CSS.

Note that external stylesheets can still be used to style Vega SVG content, and may now have higher specificity due to the use of attributes.

Changelog

Changes from v5.12.2:

monorepo

• Update eslint config to flag trailing commas.

vega

• Add initialization timing to test spec viewer page.
• Remove dangling commas.
• Update dev dependencies.

vega-cli

• Update SVG test cases.

vega-format

• Remove dangling commas.

vega-geo

• Remove dangling commas.

vega-hierarchy

• Remove dangling commas.

vega-parser

• Fix trailing function argument commas in axis utils. (#​2645, thanks @​armanozak!)
• Remove dangling commas.

vega-projections-extended

• Update dev dependencies.

vega-scenegraph

• Favor SVG presentation attributes over CSS style. (#​2640)
• Fix clipped group picking for canvas. (#​2600)
• Remove dangling commas, other code clean-up.

vega-schema

• Remove dangling commas.

vega-time

• Remove dangling commas.

vega-transforms

• Remove dangling commas.

v5.12.2

Compare Source

Changes from v5.12.1:

vega-scenegraph

• Add canvas handler event listeners necessary for state management. Fixes a regression introduced in v5.12.1. (#​2641)

vega-typings

• Fix typings for locale specification and View API. (thanks @​haldenl!)

v5.12.1

Compare Source

Changes from v5.12.0:

monorepo

• Switch from Travis CI to GitHub Actions. (thanks @​domoritz!)

vega-cli

• Add tests for vega-cli.

vega-parser

• Update code style for config constants.

vega-scenegraph

• Add class to svg root group, localize SVG stylesheet to that class. (#​2618)
• Lazily register CanvasHandler event listeners. By avoiding unneeded listeners, this change avoids a number of passive listener violation warnings. (#​2621)

vega-transforms

• Fix regression of string to number conversion in aggregate sum op. (thanks @​haldenl!)

vega-typings

• Update View typings.
• Fix missing color schemes in typings. (thanks @​domortiz!)

vega-view

• Code clean up.

v5.12.0

Compare Source

Notable Additions

• View-specific locale management for number and date formatting. The View constructor accepts a locale option, and Vega specs support a config.locale property. Locale objects should have number and/or time properties that map to valid d3-format or d3-time-format locale definitions.
• View toCanvas now accepts an externalContext option to draw into a separately managed canvas instance. For example, one could draw multiple Vega views into the same node-canvas instance for server-side PDF document generation.
• Initial support for signal-valued axis orient properties. This addition allows the position of an axis (e.g., left versus right) to be dynamically updated at runtime. The feature should be considered experimental; subtle bugs may still arise.
• Internal refactoring to support content security policy (CSP) in the future. The Vega parser accepts an ast option flag to include generated abstract syntax trees for expressions in the parser output. All Function constructor use for generated code is now consolidated into a single file in the vega-runtime package and could be overridden if an expression AST interpreter is implemented.
• Bug fixes! See below...

Changelog

Changes from v5.11.1:

vega

• Update bar-time test specification to test locale config usage.
• Update budget-forecasts test specification.
• Update to use refactored runtime context.

vega-cli

• Update to use locale view constructor option.

vega-dataflow

• Add locale property to set a dataflow-specific locale for number and date formatting.

vega-encode

• Update to use centralized locale management. Transforms now access the dataflow-specific locale via the input pulse.

vega-expression

• Fix handling of this global variable.

vega-format

• New package for format methods that centralizes locale management.

vega-functions

• Add centralized locale management. Format functions now access the dataflow-specific locale via the runtime context object, available to expression functions via the this context.
• Add and export expression parser, support AST export option.
• Add internal scale functions for use by encoders.
• Fix scale dependencies: non-literal scale references should depend on all scales.

vega-geo

• Fix contour, density2D size setter input checks.

vega-loader

• Add UTC parser parameter to read method.
• Use the default locale when custom time format parsers are not provided.

vega-parser

• Internal breaking change: Output runtime specification has changed the encoding of parsed expression functions. Generated code is now wrapped in an object and stored in the code property.
• Internal breaking change: Generated expression code no longer includes method variable definitions or additional logic. These have been moved to vega-runtime.
• Add signal support for axis translate property. (Thanks @​haldenl!)
• Add experimental signal support for axis orient property. (Thanks @​haldenl!)
• Add parsing of locale config, include in runtime spec output.
• Add options argument to parse.
• Add boolean ast parse option to enable AST output from expression parser.
• Refactor to use expression parser for synthesized encoder logic.
• Fix circular dependencies.

vega-runtime

• Internal breaking change: The runtime now assumes the updated vega-parser output format. All code generation beyond standard expression parser output has now been consolidated into the runtime parsing process.
• Propagate locale config to runtime context object.
• Refactor code, add optimized code generation for accessors and comparators.
• Refactor all non-standard code generation to the runtime context.
• Fix circular dependencies.

vega-scale

• Internal breaking change: Update to use centralized locale management. Formatting methods now require a locale parameter as the first argument.
• Fix valid tick method to sort ticks based on scale range values. (#​2579)

vega-scenegraph

• Add externalContext CanvasRenderer option. (Thanks @​pixelspark!)
• Add resetSVGDefIds to reset gradient and clip id counter. (Thanks @​kanitw!)
• Add SVG style block, set default fill and miter limit values. (#​2498)
• Update SVG test outputs.
• Update to use centralized locale management. The ARIA caption generators access the dataflow-specific locale via the runtime context object.
• Update reference to axis orient.
• Fix SVG radial gradient pattern fill to use style, not fill attribute.
• Fix ampersand escape in SVG attributes. (#​2608)
• Fix CSS fill inherit for tspan.

vega-schema

• Add axis translate signal support to schema.
• Add signal-valued axis orient to schema.

vega-time

• Internal breaking change: Remove formatting methods, which are now part of vega-format.

vega-transforms

• Update aggregation ops to no longer use the Function constructor.
• Update dependencies.

vega-typings

• Add externalCanvas render option to typings.
• Add axis translate signal support to typings.
• Add signal-valued axis orient to typings.

vega-util

• Update field, key, and compare methods to no longer use the Function constructor.
• Add optional arguments to inject optimized code generators for accessors and comparators.

vega-view

• Add locale input options and config handling.
• Update to use refactored runtime context.

vega-view-transforms

• Add signal support for axis translate property.
• Update reference to axis orient.
• Fix ViewLayout reflow to ensure group bounds are updated. (#​2568)
• Fix grid layout calculations with empty grid input. (#​2541)

vega-wordcloud

• Update dependencies.

v5.11.1

Compare Source

Changes from v5.11.0:

monorepo

• Update dev dependencies.

vega-hierarchy

• Update tests for tape 5.0.

vega-scenegraph

• Use single quotes for generated aria-label captions. (Thanks @​sprmn!)
• Escape double quotes in SVG attributes, add test case.

vega-statistics

• Update tests for tape 5.0.

vega-view-transforms

• Update tests for tape 5.0.

v5.11.0

Compare Source

Notable Additions

• Preliminary support for ARIA accessibility attributes in SVG output. Mark and guide definitions now include automatically-generated roles and labels, which can be customized using description and aria properties. Individual mark items do not include ARIA attributes by default (which helps prevent bloat of both the scenegraph and output SVG), but these can be added using description and aria encoding channels.
• Improve generated HTML form elements for signal bindings. Deployments that use custom CSS for styling bound elements may wish to make minor adjustments.
• dayofyear time unit support for the timeunit transform.
• dayofyear, week, utcdayofyear, and utcweek expression functions.
• Axis domainCap, gridCap, and tickCap properties.

Changelog

Changes from v5.10.1:

monorepo

• Add ARIA attribute generation documentation.
• Update eslint setup, consolidate configuration.
• Update dev dependencies.

vega

• Add calendar test specification.
• Add overview-detail-bins test spec to test suite.
• Update crossfilter test scenes to include description property output.

vega-encode

• Move internal tick, label utilities to vega-scale.
• Fix valid tick check calculation. (#​2531)

vega-functions

• Add dayofyear, week, utcdayofyear, utcweek expression functions.

vega-geo

• Fix density utility size input checking bug.

vega-parser

• Add ARIA attribute generation for marks and guides via aria and description properties.
• Add backing scale names to axis, legend datum objects.
• Add zindex support for guide config.
• Add axis domainCap, gridCap, and tickCap properties. (Thanks @​kanitw!)

vega-scale

• Add tick, label guide utilities from vega-encode.
• Add domainCaption utility.
• Fix overflow with large domain and small tickMinStep (#​2550, thanks @​rwoollen!)

vega-scenegraph

• Add ARIA attribute generation to SVG renderers:
  • Parent <g> tags for mark items include automatic role and aria-roleDescription attributes.
  • Parent <g> tags for axes and legends include automatic aria-label captions.
  • Attribute generation for mark and guide definitions can be customized using the aria and description properties. If aria is false, the content is hidden from the accessibility tree by setting aria-hidden SVG attribute. The description property determines the aria-label SVG attribute.
  • Individual mark items do not include ARIA attributes by default, but these can be added using the encoding channels aria and description. If a description is provided and aria !== false, then Vega will generate accompanying role and aria-roledescription attributes for a mark item.
• Provide experimental ariaRole and ariaRoleDescription encoding channels for individual marks, which override the default role and aria-roledescription attributes generated by Vega. However, note that these are experimental features and so may change at a later date.

vega-schema

• Add ARIA accessibility properties to mark, guide, and encode schemas.
• Add axis domainCap, gridCap, and tickCap properties.

vega-time

• Add dayofyear time unit support and corresponding tests.
• Add dayofyear, week, utcdayofyear, utcweek utility functions.
• Add export for TIME_UNITS array of valid time unit strings.

vega-transforms

• Update TimeUnit transform parameter schema to enforce valid time unit strings.

vega-typings

• Add ARIA accessibility properties to mark, guide, and encode typings.
• Add dayofyear option to TimeUnit transform typings.
• Add zindex support for guide config.
• Add axis domainCap, gridCap, and tickCap properties.

vega-view

• Improved semantic HTML for generated signal bindings to form input elements.

v5.10.1

Compare Source

Changes from v5.10.0:

vega-encode

• Update default guide label format to support multi-line arrays. (#​2456)

vega-loader

• Use startsWith rather than indexOf for string prefix checks.

vega-parser

• Use startsWith rather than indexOf for string prefix checks.
• Set default fill and size for trail mark config.

vega-transforms

• Fix window operator init state for prev_value and next_value. (#​2475.)

vega-typings

• Update mark config for arc mark.

vega-view-transforms

• Fix Overlap transform to early exit when there are no items (#​2449).

v5.10.0

Compare Source

Notable Additions

• The Vega parser now generates a built-in background signal which the view uses to set the background color. While not technically a breaking change (specs will still parse and evaluate successfully), existing specs that use a signal named "background" may not render the same as before, in which case a different signal name should be used.
• Top-level properties (autosize, background, padding, width, height) accept signal references, such as {"signal": "<expr>"}, which map to a signal definition's update property. If the top-level signals array contains an entry that matches one of these properties, the definitions will be merged, with precedence given to the properties defined in the signals array.
• Vega views now include ARIA attributes on the view container DOM element. The role attribute is set to "figure", and the aria-label attribute is set to the specification description property.
• The aggregate and window transforms support the product operation to multiply values.
• The config supports a top-level lineBreak option for setting a global default for text line breaks. This property should be a string or regexp value, or a corresponding signal reference.
• Support for text baseline values line-top and line-bottom. These values are similar to top and bottom baselines, but calculated relative to the lineHeight rather than fontSize alone.
• Support for color blend modes via the new blend encoding channel. The allowed values are: multiply, screen, overlay, darken, lighten, color-dodge, color-burn, hard-light, soft-light, difference, exclusion, hue, saturation, color, luminosity. For Canvas rendering, the blend is set via the context 2D globalCompositeOperation property. For SVG rendering, the blend is set via the CSS mix-blend-mode style. The default Vega value is null (or undefined), which maps to the default values "source-over" (for Canvas) and "normal" (for SVG). For more, see the Canvas globalCompositeOperation and CSS mix-blend-mode documentation, including limitations in cross-browser support.
• Support for configuration of cross-origin image handling. Vega uses crossOrigin="anonymous" by default for loaded images, which allows images loaded from a different host to be included in exported visualization images (and thereby avoid "tainted canvas errors"), so long as the server provides permission via proper CORS headers. This default can be overridden by providing loader options to the Vega view that include a crossOrigin property. If this property is defined and maps to a value of null or undefined, then a no-cors fetch will be performed instead.
• Add axis labelOffset property to adjust axis label position in addition to tickOffset, and labelLineHeight to set the line height for multi-line axis labels.

Changelog

Changes from v5.9.2:

docs

• Add description entries to all specifications in the example gallery.
• Update documentation for all new features.

vega

• Update test specifications to avoid use of signals named "background".

vega-loader

• Add crossOrigin URI sanitization configuration for images. (#​2238)

vega-parser

• Add built-in background signal to drive view background.
• Add support for top-level properties to take signal-values.
• Add application of lineBreak config option to text marks. (#​2370)
• Add axis labelOffset property. (thanks @​kanitw! #​2317)
• Add axis labelLineHeight property. (thanks @​kanitw! #​2437)
• Add description support to parser output and config.

vega-scenegraph

• Add crossOrigin image handling support. (#​2238)
• Add blend encoding channel support. (#​2311)
• Add line-top, line-bottom text baseline options. (#​2395)
• Add text trimming to ensure consistent output. (#​2418)
• Fix linear gradient to use normalized bounding box coordinates. (#​2365)
• Fix canvas damage/redraw: Align to base pixel grid in case of non-integer scaling. (#​2425)

vega-schema

• Add blend encoding to schema.
• Add line-top, line-bottom text baseline options. (#​2395)
• Add top-level signal-valued properties to schema.
• Add axis labelOffset and labelLineHeight properties to schema.

vega-transforms

• Add product aggregate operation. (#​2307)

vega-typings

• Add blend encoding to typings.
• Add line-top, line-bottom text baseline options. (#​2395)
• Add top-level signal-valued properties to typings.
• Add lineBreak config typing. (#​2370)
• Add axis labelOffset and labelLineHeight typings.

vega-util

• Fix prototype pollution vulnerability.

vega-view

• Add ARIA attributes and View description method.
• Use background signal to control the view background color.
• Update padding method to handle numeric values.

vega-view-transforms

• Fix axis title layout bounds to avoid improper padding offset. (#​2368)
• Fix view layout resize code to avoid invocation of padding until needed.

v5.9.2

Compare Source

Changes from v5.9.1:

docs

• Add clock, watch, and pacman examples. (Thanks @​mathiastiberghien and @​domoritz!)

monorepo

• Update dev dependencies.

vega

• Allow patch updates for Vega packages.
• Add images-inline test specification.

vega-loader

• Fix URI sanitization to accept data: prefix URIs. (#​2407)

vega-parser

• Fix legend columns value handling. (#​2268)

vega-scenegraph

• Add memoization to speed up text width measurements. (Thanks @​domoritz!)

vega-schema

• Fix date-type transform parameter support.

vega-statistics

• Fix exponential regression robustness, mean-center x-values. (#​2378)

vega-transforms

• Fix TimeUnit maxbins, extent parameter support. (Thanks @​haldenl!)

vega-typings

• Fix missing zindex mark encoding typing. (#​2341)
• Update typings. (Thanks @​danmarshall, @​domoritz, @​kanitw!)

vega-util

• Add lruCache data structure, tests, and documentation.

v5.9.1

Compare Source

Changes from v5.9.0:

vega

• Fix rollup script to resolve symlinks.

vega-encode

• Fix log scale legend values and format. (#​2290)

vega-projection-extended

• Fix rollup script to resolve symlinks.

vega-regression

• Update vega-statistics dependency.

vega-statistics

• Fix r-squared calculation for poly and quad regression. (Thanks @​jakevdp!)

vega-time

• Fix time floor step bug, add tests. (#​2270)

vega-util

• Fix splitAccessPath escape handling, add tests. (#​2287)

v5.9.0

Compare Source

Notable Additions:

• New Annual Precipitation example.
• Signal bindings for select and radio input now support a labels array.
• Group mark strokeOffset and strokeForeground properties to control rectangle rendering.
• The default set of map projections now includes the mollweide projection.
• Improved numerical robustness for regression methods.
• Support translate and scale transformations in the isocontour transform.
• Support for fully asynchronous data loading, via data async flag.
• Support for adding new scale implementations at runtime.

Changes from v5.8.1:

docs

• Add Annual Precipitation example. (thanks @​mattijn!)

vega

• Add ES5 build support via Babel. (thanks @​nyurik!)
• Add isocontour-precipitation test specification. (thanks @​mattijn!)
• Update dynamic-url test specification to include async.
• Update test scenegraphs in response to scale updates.

vega-dataflow

• Add asynchronous operator execution support.

vega-encode

• Fix legend item lookup bug.
• Add spacing to legend range labels.

vega-event-selector

• Add initial TypeScript typings.

vega-expression

• Add initial TypeScript typings.

vega-geo

• Add isocontour scale and translate support. (#​2163)

vega-parser

• Add async data loading property.

vega-projection

• Add mollweide projection to default set.
• Update dependencies.

vega-projection-extended

• Add hyperElliptical, interruptedQuarticAuthalic, nicolosi projections.
• Drop naturalEarth1, mollweide projections (move to vega-projection defaults).

vega-scale

• Refactor scale and metadata registration. (thanks @​bmatcuk!)
• Add initial TypeScript typings.
• Update dependencies.

vega-scenegraph

• Add group mark strokeOffset property. (#​2186)
• Add group mark strokeForeground property. (#​2197)
• Fix group offset adjustment to interpolate smoothly.
• Fix SVG renderer clip maintenance bug. (thanks @​donghaoren!)
• Fix boundContext to calculate tight bounds for Bezier curves.
• Fix canvas renderer group gradient offset bug.

vega-schema

• Add signal bind labels to schema.
• Add isocontour transform translate parameter to schema.
• Add async data property to schema.
• Add group mark strokeOffset to schema.

vega-statistics

• Fix regression methods for numerical stability.
• Fix regression number coercion.

vega-transforms

• Add Load transform async parameter.
• Fix to use infinite bin values outside extent bounds. (#​2227)
• Fix bin stop boundary error. (#​2181)

vega-typings

• Add signal bind labels typings.
• Add isocontour transform translate parameter typings.
• Add async data property typing.
• Add group mark strokeOffset typings.
• Update config object typings.

vega-util

• Fix infinite loop bug in extent. (#​2177, thanks @​tuner!)
• Fix null result case output for extentIndex.
• Add tests for extent and extentIndex.

vega-view

• Add labels property for radio/select bindings.

vega-wordcloud

• Fix fontSize flooring to handle floating point error.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.