Skip to content

Update dependency mathjs to v7 [SECURITY] - #912

Closed
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-mathjs-vulnerability
Closed

Update dependency mathjs to v7 [SECURITY]#912
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/npm-mathjs-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Aug 6, 2024 •
edited
Loading

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Change Age Confidence
mathjs (source) ^5.0.0 → ^7.0.0 age confidence

Prototype Pollution in mathjs

CVE-2020-7743 / GHSA-x2fc-mxcx-w4mf

More information

Details

The package mathjs before 7.5.1 are vulnerable to Prototype Pollution via the deepExtend function that runs upon configuration updates.

Severity

  • CVSS Score: 7.3 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

josdejong/mathjs (mathjs)

v7.5.1

Compare Source

  • Fix object pollution vulnerability in math.config. Thanks Snyk.

v7.5.0

Compare Source

  • Function pickRandom now allows randomly picking elements from matrices
    with 2 or more dimensions instead of only from a vector, see #​1974.
    Thanks @​KonradLinkowski.

v7.4.0

Compare Source

  • Implemented support for passing a precision in functions ceil, floor,
    and fix, similar to round, see #​1967, #​1901. Thanks @​rnd-debug.
  • Implemented function rotationMatrix, see #​1160, #​1984. Thanks @​rnd-debug.
  • Implement a clear error message when using sqrtm with a matrix having
    more than two dimensions. Thanks @​KonradLinkowski.
  • Update dependency decimal.js to 10.2.1.

v7.3.0

Compare Source

  • Implemented functions usolveAll and lsolveAll, see #​1916. Thanks @​m93a.
  • Implemented support for units in functions std and variance, see #​1950.
    Thanks @​rnd-debug.
  • Implemented support for binary, octal, and hexadecimal notation in the
    expression parser, and implemented functions bin, oct, and hex for
    formatting. Thanks @​clnhlzmn.
  • Fix #​1964: inconsistent calculation of negative dividend modulo for
    BigNumber and Fraction. Thanks @​ovk.

v7.2.0

Compare Source

v7.1.0

Compare Source

  • Implement support for recursion (self-referencing) of typed-functions,
    new in typed-function@2.0.0. This fixes #​1885: functions which where
    extended with a new data type did not always work. Thanks @​nickewing.
  • Fix #​1899: documentation on expression trees still using old namespace
    math.expression.node.* instead of math.*.

v7.0.2

Compare Source

  • Fix #​1882: have DenseMatrix.resize and SparseMatrix.resize accept
    DenseMatrix and SparseMatrix as inputs too, not only Array.
  • Fix functions sum, prod, min, and max not throwing a conversion error
    when passing a single string, like sum("abc").

v7.0.1

Compare Source

  • Fix #​1844: clarify the documentation of function eigs. Thanks @​Lazersmoke.
  • Fix #​1855: Fix error in the documentation for math.nthRoots(x).
  • Fix #​1856: make the library robust against Object prototype pollution.

v7.0.0

Compare Source

Breaking changes:

  • Improvements in calculation of the dot product of complex values.
    The first argument is now conjugated. See #​1761. Thanks @​m93a.
  • Dropped official support for Node.js v8 which has reached end of life.
  • Removed all deprecation warnings introduced in v6.
    To upgrade smoothly from v5 to v7 or higher, upgrade to v6 first
    and resolve all deprecation warnings.

v6.6.5

Compare Source

  • Fix #​1834: value Infinity cannot be serialized and deserialized.
    This is solved now with a new math.replacer function used as
    JSON.stringify(value, math.replacer).
  • Fix #​1842: value Infinity not turned into the latex symbol \\infty.

v6.6.4

Compare Source

  • Fix published files containing Windows line endings (CRLF instead of LF).

v6.6.3

Compare Source

  • Fix #​1813: bug in engineering notation for numbers of function format,
    sometimes resulting in needless trailing zeros.
  • Fix #​1808: methods .toNumber() and .toNumeric() not working on a
    unitless unit.
  • Fix #​1645: not being able to use named operators mod, and, not, or,
    xor, to, in as object keys. Thanks @​Veeloxfire.
  • Fix eigs not using config.epsilon.

v6.6.2

Compare Source

  • Fix #​1789: Function eigs not calculating with BigNumber precision
    when input contains BigNumbers.
  • Run the build script during npm prepare, so you can use the library
    directly when installing directly from git. See #​1751. Thanks @​cinderblock.

v6.6.1

Compare Source

v6.6.0

Compare Source

  • Implemented function eigs, see #​1705, #​542 #​1175. Thanks @​arkajitmandal.
  • Fixed #​1727: validate matrix size when creating a DenseMatrix using
    fromJSON.
  • Fixed DenseMatrix.map copying the size and datatype from the original
    matrix instead of checking the returned dimensions and type of the callback.
  • Add a caret to dependencies (like) ^1.2.3) to allow downstream updates
    without having to await a new release of mathjs.

v6.5.0

Compare Source

v6.4.0

Compare Source

  • Extended function dimension with support for n-dimensional points.
    Thanks @​Veeloxfire.

v6.3.0

Compare Source

  • Improved performance of factorial for BigNumber up to a factor two,
    see #​1687. Thanks @​kmdrGroch.

v6.2.5

Compare Source

  • Fixed IndexNode using a hardcoded, one-based implementation of index,
    making it impossible to instantiate a zero-based version of the expression
    parser. See #​782.

v6.2.4

Compare Source

v6.2.3

Compare Source

  • Fixed #​1640: function mean not working for units. Thanks @​clintonc.
  • Fixed #​1639: function min listed twice in the "See also" section of the
    embedded docs of function std.
  • Improved performance of isPrime, see #​1641. Thanks @​arguiot.

v6.2.2

Compare Source

  • Fixed methods map and clone not copying the dotNotation property of
    IndexNode. Thanks @​rianmcguire.
  • Fixed a typo in the documentation of toHTML. Thanks @​maytanthegeek.
  • Fixed #​1615: error in the docs of isNumeric.
  • Fixed #​1628: Cannot call methods on empty strings or numbers with value 0.

v6.2.1

Compare Source

  • Fixed #​1606: function format not working for expressions.

v6.2.0

Compare Source

  • Improved performance of combinationsWithRep. Thanks @​waseemyusuf.
  • Add unit aliases bit and byte.
  • Fix docs referring to bit and byte instead of bits and bytes.
  • Updated dependency typed-function@1.1.1.

v6.1.0

Compare Source

v6.0.4

Compare Source

  • Fixed #​1554, #​1565: ES Modules where not transpiled to ES5, giving issues on
    old browsers. Thanks @​mockdeep for helping to find a solution.

v6.0.3

Compare Source

  • Add unpkg and jsdelivr fields in package.json pointing to UMD build.
    Thanks @​tmcw.
  • Fix #​1550: nested user defined function not receiving variables of an
    outer user defined function.

v6.0.2

Compare Source

  • Fix not being able to set configuration after disabling function import
    (regression since v6.0.0).

v6.0.1

Compare Source

  • Fix function reference not published in npm library.
  • Fix function evaluate and parse missing in generated docs.

v6.0.0

Compare Source

!!! BE CAREFUL: BREAKING CHANGES !!!

Most notable changes

  1. Full support for ES modules. Support for tree-shaking out of the box.

    Load all functions:

    import * as math from 'mathjs'

    Use a few functions:

    import { add, multiply } from 'mathjs'

    Load all functions with custom configuration:

    import { create, all } from 'mathjs'
const config = { number: 'BigNumber' }
const math = create(all, config)

    Load a few functions with custom configuration:

    import { create, addDependencies, multiplyDependencies } from 'mathjs'
const config = { number: 'BigNumber' }
const { add, multiply } = create({
  addDependencies,
  multiplyDependencies
}, config)

  2. Support for lightweight, number-only implementations of all functions:

    import { add, multiply } from 'mathjs/number'

  3. New dependency injection solution used under the hood.

Breaking changes

  • Node 6 is no longer supported.

  • Functions config and import are not available anymore in the global
    context:

    // v5
import * as mathjs from 'mathjs'
mathjs.config(...) // error in v6.0.0
mathjs.import(...) // error in v6.0.0

    Instead, create your own mathjs instance and pass config and imports
    there:

    // v6
import { create, all } from 'mathjs'
const config = { number: 'BigNumber' }
const mathjs = create(all, config)
mathjs.import(...)

  • Renamed function typeof to typeOf, var to variance,
    and eval to evaluate. (the old function names are reserved keywords
    which can not be used as a variable name).

  • Deprecated the Matrix.storage function. Use math.matrix instead to create
    a matrix.

  • Deprecated function math.expression.parse, use math.parse instead.
    Was used before for example to customize supported characters by replacing
    math.parse.isAlpha.

  • Moved all classes like math.type.Unit and math.expression.Parser to
    math.Unit and math.Parser respectively.

  • Fixed #​1428: transform iterating over replaced nodes. New behavior
    is that it stops iterating when a node is replaced.

  • Dropped support for renaming factory functions when importing them.

  • Dropped fake BigNumber support of function erf.

  • Removed all index.js files used to load specific functions instead of all, like:

    // v5
// ... set up empty instance of mathjs, then load a set of functions:
math.import(require('mathjs/lib/function/arithmetic'))

    Individual functions are now loaded simply like:

    // v6
import { add, multiply } from 'mathjs'

    To set a specific configuration on the functions:

    // v6
import { create, addDependencies, multiplyDependencies } from 'mathjs'
const config = { number: 'BigNumber' }
const math = create({ addDependencies, multiplyDependencies }, config)

    See example advanced/custom_loading.js.

  • Updated the values of all physical units to their latest official values.
    See #​1529. Thanks @​ericman314.

Non breaking changes
  • Implemented units t, tonne, bel, decibel, dB, and prefixes
    for candela. Thanks @​mcvladthegoat.
  • Fixed epsilon setting being applied globally to Complex numbers.
  • Fix math.simplify('add(2, 3)') throwing an error.
  • Fix #​1530: number formatting first applied lowerExp and upperExp
    and after that rounded the value instead of the other way around.
  • Fix #​1473: remove 'use strict' in every file, not needed anymore.

v5.10.3

Compare Source

  • Fixed dependency del being a dependency instead of devDependency.

v5.10.2

Compare Source

  • Fix #​1515, #​1516, #​1517: broken package due to a naming conflict in
    the build folder of a util file typeOf.js and typeof.js.
    Solved by properly cleaning all build folders before building.

v5.10.1

Compare Source

  • Fix #​1512: format using notation engineering can give wrong results
    when the value has less significant digits than the number of digits in
    the output.

v5.10.0

Compare Source

  • Fix lib/header.js not having filled in date and version. Thanks @​kevjin.
  • Upgraded dependency decimal.js@10.2.0, fixing an issue on node.js 12.

v5.9.0

Compare Source

  • Implemented functions row and column (see #​1413). Thanks @​SzechuanSage.
  • Fixed #​1459: engineering notation of function format not available
    for BigNumber.
  • Fixed #​1465: node.toHTML() not correct for unary operators like
    factorial.

v5.8.0

Compare Source

  • Implemented new function apply. Thanks @​bnlcas.
  • Implemented passing an optional dimension argument to std and var.
    Thanks @​bnlcas.

v5.7.0

Compare Source

v5.6.0

Compare Source

  • Upgrade decimal.js to v10.1.1 (#​1421).
  • Fixed #​1418: missing whitespace when stringifying an expression
    containing "not".

v5.5.0

Compare Source

  • Fixed #​1401: methods map and forEach of SparseMatrix not working
    correctly when indexes are unordered.
  • Fixed #​1404: inconsistent rounding of negative numbers.
  • Upgrade tiny-emitter to v2.1.0 (#​1397).

v5.4.2

Compare Source

  • Fixed math.format not working for BigNumbers with a precision above
    1025 digits (see #​1385). Thanks @​ericman314.
  • Fixed incorrect LaTeX output of RelationalNode. Thanks @​rianmcguire.
  • Fixed a bug the methods map, forEach, traverse, and transform
    of FunctionNode.

v5.4.1

Compare Source

  • Fix #​1378: negative bignumbers not formatted correctly.
  • Upgrade fraction.js to version 4.0.12 (#​1369).

v5.4.0

Compare Source

  • Extended sum.js to accept a dimension input to calculate the sum over a
    specific axis. Thanks @​bnlcas.
  • Fix #​1328: objects can't be written multi-line. Thanks @​GHolk.
  • Remove side effects caused by Unit.format and Unit.toString,
    making changes to the unit on execution. Thanks @​ericman314.

v5.3.1

Compare Source

v5.3.0

Compare Source

v5.2.3

Compare Source

  • Fixed #​1293: non-unicode characters in escape-latex giving issues in some
    specific cases. Thanks @​dangmai.
  • Fixed incorrect LaTeX output of function bitNot, see #​1299. Thanks @​FSMaxB.
  • Fixed #​1304: function pow not supporting inputs pow(Unit, BigNumber).
  • Upgraded dependencies (escape-latex@1.2.0)

v5.2.2

Compare Source

v5.2.1

Compare Source

  • Fixed unit rod being defined as 5.02921 instead of 5.0292.
    Thanks @​ericman314.
  • Upgraded dependencies (fraction.js@4.0.10)
  • Upgraded devDependencies (@babel/core@7.1.2, nyc@13.1.0,
    webpack@4.21.0).

v5.2.0

Compare Source

  • Docs: fix the browser example rocket_trajectory_optimization.html (#​3654).
    Thanks @​dvd101x.

v5.1.2

Compare Source

  • Fixed a typo in the docs of parse. Thanks @​mathiasvr.
  • Fixed #​1222: a typo in the docs of subset.
  • Fixed #​1236: quantileSeq has inconsistent return.
  • Fixed #​1237: norm sometimes returning a complex number instead of
    number.
  • Upgraded dependencies (fraction.js@4.0.9)
  • Upgraded devDependencies (babel@7, karma-webpack@3.0.4,
    nyc@13.0.1, standard@12.0.0, uglify-js@3.4.9, webpack@4.17.2)

v5.1.1

Compare Source

v5.1.0

Compare Source

v5.0.4

Compare Source

  • Strongly improved the performance of functions factorial for numbers.
    This improves performance of functions gamma, permutation, and
    combination too. See #​1170. Thanks @​honeybar.
  • Strongly improved the performance of function reshape, thanks to a
    friend of @​honeybar.

v5.0.3

Compare Source

  • Fixed many functions (for example add and subtract) not working
    with matrices having a datatype defined.
  • Fixed #​1147: bug in format with engineering notation in outputting
    the correct number of significant figures. Thanks @​ericman314.
  • Fixed #​1162: transform functions not being cleaned up when overriding
    it by importing a factory function with the same name.
  • Fixed broken links in the documentation. Thanks @​stropitek.
  • Refactored the code of parse into a functional approach.
    Thanks @​harrysarson.
  • Changed decimal.js import to ES6. Thanks @​weinshel.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/npm-mathjs-vulnerability branch from dae659c to c9d530a Compare August 10, 2025 14:50
@renovate
renovate Bot force-pushed the renovate/npm-mathjs-vulnerability branch from c9d530a to 581e406 Compare November 18, 2025 12:36
@renovate renovate Bot changed the title Update dependency mathjs to v7 [SECURITY] Update dependency mathjs to v7 [SECURITY] - autoclosed Mar 27, 2026
@renovate renovate Bot closed this Mar 27, 2026
@renovate
renovate Bot deleted the renovate/npm-mathjs-vulnerability branch March 27, 2026 02:02
@renovate renovate Bot changed the title Update dependency mathjs to v7 [SECURITY] - autoclosed Update dependency mathjs to v7 [SECURITY] Mar 30, 2026
@renovate renovate Bot reopened this Mar 30, 2026
@renovate
renovate Bot force-pushed the renovate/npm-mathjs-vulnerability branch 2 times, most recently from 581e406 to e9ea69f Compare March 30, 2026 17:54
@renovate renovate Bot changed the title Update dependency mathjs to v7 [SECURITY] Update dependency mathjs to v7 [SECURITY] - autoclosed Apr 27, 2026
@renovate renovate Bot closed this Apr 27, 2026
@renovate renovate Bot changed the title Update dependency mathjs to v7 [SECURITY] - autoclosed Update dependency mathjs to v7 [SECURITY] Apr 27, 2026
@renovate renovate Bot reopened this Apr 27, 2026
@renovate
renovate Bot force-pushed the renovate/npm-mathjs-vulnerability branch 2 times, most recently from e9ea69f to b590889 Compare April 27, 2026 21:28
@toddmedema toddmedema closed this Sep 9, 2026
@renovate

renovate Bot commented Sep 9, 2026

Copy link
Copy Markdown
Contributor Author

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 7.x releases. But if you manually upgrade to 7.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@toddmedema