[totally-not-ai]

Review risk: two-way door — @vaadin/charts only; affects chart rendering, exporting and the bundled Highcharts security patches

Summary

Upgrades highcharts in @vaadin/charts from 12.2.0 to 12.6.2 (the latest 12.x), with workarounds for regressions introduced between 12.3 and 12.6, and broader visual coverage. Highcharts backports fixes, including security fixes, only to its latest minor version.

Fixes #12983

Companion PR for the Flow SVG generator: vaadin/flow-components#10520

The new visual tests (more chart types and the non-styled suite) landed in #13291 with Highcharts 12.2.0 baselines. This PR updates the baselines that change with 12.6.2.

What changed

• Bump highcharts to 12.6.2.
• vaadin-chart-mixin.js workarounds:
  • Export path: since 12.3 exporting.local defaults to true, so PNG, JPEG and SVG exports render in the browser instead of being posted to the export server. That makes exporting.url and width have no effect, fails PDF exports when fallbackToExportServer is off, and needs blob: and data: sources in a Content Security Policy. Remove the default and wrap Exporting.prototype.exportChart to keep the 12.2 rule: export on the server, unless the app loads the offline-exporting module (which used to switch the download menu items and exportChartLocal() to the browser) or sets exporting.local itself. To be removed in the next major version to adopt the Highcharts default.
  • Export styles: since 12.3 nothing calls Chart.prototype.getSVG, so wrap Exporting.prototype.getSVG and fire afterExport once the async export settles, also when it fails. Exports are counted per chart and a print is tracked separately, so the body keeps the copied styles and the styled-mode attribute until the last overlapping export or print is done, also when both are of the same chart. Detaching a chart while its export is pending removes them too, as the destroyed chart can no longer fire afterExport.
  • Solid gauge colors (Solid Gauge arc highcharts-color-{n} class removed when yAxis has stops (regression in 12.3.0; worked in 12.2.0) highcharts/highcharts#23279): re-apply the point color classes in styled mode when yAxis.stops carries no usable color.
  • Animated solid gauge clipping (Regression: clipped pane in solid gauge highcharts/highcharts#24460, since 12.5): port the upstream fix that uses the plot area as the clip box for series on radial axes.
  • Outside tooltip in a scrollable plot area (Wrong tooltip position with scrollable plot area highcharts/highcharts#24548, since 12.6): port the upstream fix so the tooltip stays next to its point.
• Visual baselines updated for 12.6.2. The new visual tests themselves are in test: add chart visual coverage for more chart types and non-styled mode #13291.
• Separate commit: remove the patches in highcharts-patches.js that 12.6.1/12.6.2 now include (setNestedProperty, addCredits, AST.filterUserAttributes for xlink:href, AST.parseMarkup), the tests of the markup parser fallback, and highcharts-policy.js, which only the markup patch used. The tests for point keys, credits links and xlink:href stay, so they now check the fixes Highcharts ships. optionsToObject and _defaultSetter stay.

Behavior changes (release notes)

• exportChart() returns a promise.
• credits.href only accepts links matching AST.allowedReferences (https://, http://, mailto:, /, ./, ../, #). Previously our patch only rejected javascript:, vbscript: and data:, so e.g. about.html or tel: links are now ignored.
• A vertical heatmap color axis is no longer reversed (12.4); colorAxis.reversed: true restores the old look.
• Some y-axis grid lines move by 1 px, sub-pixel changes on pie edges, markers and polar panes.

Test summary

• Unit tests for each workaround (export events including failed exports and exports overlapping with another export or a print, solid gauge classes, clip box, outside tooltip position, annotation labels), styled and non-styled.
• Unit tests for the export path: the export server by default and from the download menu items, the browser when exporting.local is set as an option or passed to exportChart(), and the browser from exportChartLocal() and the download menu items when the offline-exporting module is loaded.
• Regression tests for point keys, credits links and xlink:href run against 12.6.2 without the removed patches.
• Charts unit tests, ESLint and tsc pass locally.
• Visual baselines regenerated for 12.6.2, including the chart types and non-styled scenarios added in test: add chart visual coverage for more chart types and non-styled mode #13291.

🤖 Generated with Claude Code

Working on behalf of Serhii

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud