The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Jul 2, 2026 5:45pm

PR Summary

Low Risk
Patch-level dependency upgrade with no logic changes; main residual risk is minor chart/tooltip behavior differences in the PPTX ECharts path.

Overview
Security dependency bump only — upgrades echarts from 6.0.0 to 6.1.0 in apps/sim/package.json and refreshes bun.lock, which also pulls zrender to 6.1.0.

This addresses a medium-severity XSS (GHSA-fgmj-fm8m-jvvx / CVE-2026-45249) where Lines-series tooltip rendering could inject HTML via series.data[i].name when no custom tooltip.formatter is set. No application source changes; charts still go through the existing PPTX chart-renderer ECharts integration.

^{Reviewed by Cursor Bugbot for commit e30da31. Configure here.}

Greptile Summary

This PR bumps echarts from 6.0.0 to 6.1.0 and updates zrender (its peer dependency) from 6.0.0 to 6.1.0 in the lockfile to patch CVE-2026-45249 (GHSA-fgmj-fm8m-jvvx), a medium-severity XSS in the Lines series tooltip renderer. No application code changes are required.

• apps/sim/package.json: Exact version pin updated from 6.0.0 → 6.1.0, consistent with the existing pinning strategy used for this dependency.
• bun.lock: Both echarts and its zrender peer are updated to 6.1.0 with refreshed integrity hashes.

Confidence Score: 5/5

Safe to merge — this is a minimal, targeted dependency bump with no application code changes.

The change is limited to two files: an exact version pin update in package.json and the corresponding lockfile refresh. CVE-2026-45249 is confirmed by NVD and Apache, and echarts@6.1.0 is the designated fix. Both echarts and its zrender peer are consistently updated to 6.1.0 with correct integrity hashes. The existing pinning strategy is preserved and no other dependencies are touched.

No files require special attention.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["User renders Lines series chart\nwith series.data[i].name"] --> B{echarts version?}
    B -- "< 6.1.0 (vulnerable)" --> C["name injected via innerHTML\ninto tooltip DOM"]
    C --> D["⚠️ XSS: arbitrary HTML/script\nexecuted in browser context"]
    B -- "≥ 6.1.0 (patched)" --> E["name safely escaped\nbefore tooltip rendering"]
    E --> F["✅ Tooltip rendered safely\nas text content"]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A["User renders Lines series chart\nwith series.data[i].name"] --> B{echarts version?}
    B -- "< 6.1.0 (vulnerable)" --> C["name injected via innerHTML\ninto tooltip DOM"]
    C --> D["⚠️ XSS: arbitrary HTML/script\nexecuted in browser context"]
    B -- "≥ 6.1.0 (patched)" --> E["name safely escaped\nbefore tooltip rendering"]
    E --> F["✅ Tooltip rendered safely\nas text content"]

_{Reviews (1): Last reviewed commit: "fix(deps): bump echarts to 6.1.0 to patc..." | Re-trigger Greptile}