chore(deps): update dependency jspdf to v4 [security] (#1969)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [jspdf](https://redirect.github.com/parallax/jsPDF) | [`^3.0.2` →
`^4.0.0`](https://renovatebot.com/diffs/npm/jspdf/3.0.2/4.0.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/jspdf/4.0.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/jspdf/3.0.2/4.0.0?slim=true)
|

### GitHub Vulnerability Alerts

####
[CVE-2025-68428](https://redirect.github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2)

### Impact
User control of the first argument of the loadFile method in the node.js
build allows local file inclusion/path traversal.

If given the possibility to pass unsanitized paths to the loadFile
method, a user can retrieve file contents of arbitrary files in the
local file system the node process is running in. The file contents are
included verbatim in the generated PDFs.

Other affected methods are: `addImage`, `html`, `addFont`.

Only the node.js builds of the library are affected, namely the
`dist/jspdf.node.js` and `dist/jspdf.node.min.js` files.

Example attack vector:

```js
import { jsPDF } from "./dist/jspdf.node.js";

const doc = new jsPDF();

doc.addImage("./secret.txt", "JPEG", 0, 0, 10, 10);
doc.save("test.pdf"); // the generated PDF will contain the "secret.txt" file
```

### Patches
The vulnerability has been fixed in [email protected]. This version restricts
file system access per default. This semver-major update does not
introduce other breaking changes.

### Workarounds
With recent node versions, jsPDF recommends using the `--permission`
flag in production. The feature was introduced experimentally in v20.0.0
and is stable since v22.13.0/v23.5.0/v24.0.0. See the [node
documentation](https://nodejs.org/api/permissions.html) for details.

For older node versions, sanitize user-provided paths before passing
them to jsPDF.

### Credits
Researcher: kilkat (Kwangwoon Kim)

---

### Release Notes

<details>
<summary>parallax/jsPDF (jspdf)</summary>

###
[`v4.0.0`](https://redirect.github.com/parallax/jsPDF/releases/tag/v4.0.0)

[Compare
Source](https://redirect.github.com/parallax/jsPDF/compare/v3.0.4...v4.0.0)

This release fixes a critical path traversal/local file inclusion
[security
vulnerability](https://redirect.github.com/parallax/jsPDF/security/advisories/GHSA-f8cm-6447-x5h2)
in the jsPDF Node.js build. File system access is now restricted by
default and can be enabled by either using node's
[`--permission`](https://nodejs.org/api/permissions.html) flag or the
new
[`jsPDF.allowFsRead`](https://raw.githack.com/MrRio/jsPDF/master/docs/module-fileloading.html#~allowFsRead)
property.

There are no other breaking changes.

###
[`v3.0.4`](https://redirect.github.com/parallax/jsPDF/releases/tag/v3.0.4)

[Compare
Source](https://redirect.github.com/parallax/jsPDF/compare/v3.0.3...v3.0.4)

This release includes a bunch of bugfixes. Thanks to all contributors!

#### What's Changed

- \[Snyk] Upgrade
[@&#8203;babel/runtime](https://redirect.github.com/babel/runtime) from
7.28.3 to 7.28.4 by [@&#8203;MrRio](https://redirect.github.com/MrRio)
in [#&#8203;3895](https://redirect.github.com/parallax/jsPDF/pull/3895)
- fix: cell function now properly accepts align parameter by
[@&#8203;vishal-rathod-07](https://redirect.github.com/vishal-rathod-07)
in [#&#8203;3896](https://redirect.github.com/parallax/jsPDF/pull/3896)
- Remove duplicated function "ga" from WebPDecoder.js by
[@&#8203;jvdp](https://redirect.github.com/jvdp) in
[#&#8203;3902](https://redirect.github.com/parallax/jsPDF/pull/3902)
- Fix font state management issue
[#&#8203;3890](https://redirect.github.com/parallax/jsPDF/issues/3890)
by [@&#8203;srikanth-s2003](https://redirect.github.com/srikanth-s2003)
in [#&#8203;3891](https://redirect.github.com/parallax/jsPDF/pull/3891)
- Fix pages property to always return current array reference (
[#&#8203;3898](https://redirect.github.com/parallax/jsPDF/issues/3898) )
by [@&#8203;Opineppes](https://redirect.github.com/Opineppes) in
[#&#8203;3899](https://redirect.github.com/parallax/jsPDF/pull/3899)
- Fix jsPDF + Vite compatibility issue
[#&#8203;3851](https://redirect.github.com/parallax/jsPDF/issues/3851)
by [@&#8203;tishajain25](https://redirect.github.com/tishajain25) in
[#&#8203;3903](https://redirect.github.com/parallax/jsPDF/pull/3903)
- Do not add pages dynamically unless autoPaging is enabled by
[@&#8203;anmiles](https://redirect.github.com/anmiles) in
[#&#8203;3915](https://redirect.github.com/parallax/jsPDF/pull/3915)
- Fix: Context2d font regex too restrictive (
[#&#8203;3904](https://redirect.github.com/parallax/jsPDF/issues/3904) )
by [@&#8203;Opineppes](https://redirect.github.com/Opineppes) in
[#&#8203;3906](https://redirect.github.com/parallax/jsPDF/pull/3906)
- Fix Incorrect Typing for Margins in the TableConfig Interface
Definition by [@&#8203;Maito1794](https://redirect.github.com/Maito1794)
in [#&#8203;3816](https://redirect.github.com/parallax/jsPDF/pull/3816)

#### New Contributors

- [@&#8203;survivant](https://redirect.github.com/survivant) made their
first contribution in
[#&#8203;3897](https://redirect.github.com/parallax/jsPDF/pull/3897)
-
[@&#8203;vishal-rathod-07](https://redirect.github.com/vishal-rathod-07)
made their first contribution in
[#&#8203;3896](https://redirect.github.com/parallax/jsPDF/pull/3896)
- [@&#8203;jvdp](https://redirect.github.com/jvdp) made their first
contribution in
[#&#8203;3902](https://redirect.github.com/parallax/jsPDF/pull/3902)
- [@&#8203;srikanth-s2003](https://redirect.github.com/srikanth-s2003)
made their first contribution in
[#&#8203;3891](https://redirect.github.com/parallax/jsPDF/pull/3891)
- [@&#8203;Opineppes](https://redirect.github.com/Opineppes) made their
first contribution in
[#&#8203;3899](https://redirect.github.com/parallax/jsPDF/pull/3899)
- [@&#8203;tishajain25](https://redirect.github.com/tishajain25) made
their first contribution in
[#&#8203;3903](https://redirect.github.com/parallax/jsPDF/pull/3903)
- [@&#8203;anmiles](https://redirect.github.com/anmiles) made their
first contribution in
[#&#8203;3915](https://redirect.github.com/parallax/jsPDF/pull/3915)
- [@&#8203;josephyi](https://redirect.github.com/josephyi) made their
first contribution in
[#&#8203;3907](https://redirect.github.com/parallax/jsPDF/pull/3907)
- [@&#8203;Maito1794](https://redirect.github.com/Maito1794) made their
first contribution in
[#&#8203;3816](https://redirect.github.com/parallax/jsPDF/pull/3816)

**Full Changelog**:
<parallax/jsPDF@v3.0.3...v3.1.0>

###
[`v3.0.3`](https://redirect.github.com/parallax/jsPDF/releases/tag/v3.0.3)

[Compare
Source](https://redirect.github.com/parallax/jsPDF/compare/v3.0.2...v3.0.3)

This release fixes regressions with PNG encoding that were introduced in
v3.0.2.

##### What's Changed

- Fix division by zero when calculating word spacing by
[@&#8203;alxndr-pggm](https://redirect.github.com/alxndr-pggm) in
[#&#8203;3879](https://redirect.github.com/parallax/jsPDF/pull/3879)
- fix scaling of form object bounding boxes by
[@&#8203;HackbrettXXX](https://redirect.github.com/HackbrettXXX) in
[#&#8203;3888](https://redirect.github.com/parallax/jsPDF/pull/3888)
- fix regressions in PNG encoding that were introduced in 3.0.2 by
[@&#8203;HackbrettXXX](https://redirect.github.com/HackbrettXXX) in
[#&#8203;3887](https://redirect.github.com/parallax/jsPDF/pull/3887)

##### New Contributors

- [@&#8203;alxndr-pggm](https://redirect.github.com/alxndr-pggm) made
their first contribution in
[#&#8203;3879](https://redirect.github.com/parallax/jsPDF/pull/3879)

**Full Changelog**:
<parallax/jsPDF@v3.0.2...v3.0.3>

</details>

---

### Configuration

📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/splunk/addonfactory-ucc-generator).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi42OS4xIiwidXBkYXRlZEluVmVyIjoiNDIuNjkuMSIsInRhcmdldEJyYW5jaCI6ImRldmVsb3AiLCJsYWJlbHMiOltdfQ==-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

ui/package.json

@@ -161,7 +161,7 @@
     "string-width": "^4.2.3",
     "esbuild": "^0.25.9",
     "axios": "^1.12.0",
-    "jspdf": "^3.0.2",
+    "jspdf": "^4.0.0",
     "http-proxy-middleware": "^3.0.5",
     "@splunk/dashboard-event-handlers": "29.0.0",
     "@splunk/dashboard-inputs": "29.0.0",

ui/yarn.lock

@@ -1012,11 +1012,16 @@
     "@babel/plugin-transform-react-jsx-development" "^7.27.1"
     "@babel/plugin-transform-react-pure-annotations" "^7.27.1"
 
-"@babel/runtime@^7.10.2", "@babel/runtime@^7.12.1", "@babel/runtime@^7.12.5", "@babel/runtime@^7.14.0", "@babel/runtime@^7.17.8", "@babel/runtime@^7.2.0", "@babel/runtime@^7.21.5", "@babel/runtime@^7.26.9", "@babel/runtime@^7.27.0", "@babel/runtime@^7.27.6", "@babel/runtime@^7.9.2":
+"@babel/runtime@^7.10.2", "@babel/runtime@^7.12.1", "@babel/runtime@^7.12.5", "@babel/runtime@^7.14.0", "@babel/runtime@^7.17.8", "@babel/runtime@^7.2.0", "@babel/runtime@^7.21.5", "@babel/runtime@^7.27.0", "@babel/runtime@^7.27.6", "@babel/runtime@^7.9.2":
   version "7.28.3"
   resolved "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.3.tgz#75c5034b55ba868121668be5d5bb31cc64e6e61a"
   integrity sha512-9uIQ10o0WGdpP6GDhXcdOJPJuDgFtIDtN/9+ArJQ2NAfAmiuhTQdzkaTGR33v43GYS2UrSA0eX2pPPHoFVvpxA==
 
+"@babel/runtime@^7.28.4":
+  version "7.28.4"
+  resolved "https://registry.npmjs.org/@babel/runtime/-/runtime-7.28.4.tgz#a70226016fabe25c5783b2f22d3e1c9bc5ca3326"
+  integrity sha512-Q/N6JNWvIvPnLDvjlE1OUBLPQHH6l3CltCEsHIujp45zQUSSh8K+gHnaEX45yAT1nyngnINhvWtzN+Nb9D8RAQ==
+
 "@babel/template@^7.22.5", "@babel/template@^7.27.1", "@babel/template@^7.27.2", "@babel/template@^7.3.3":
   version "7.27.2"
   resolved "https://registry.npmjs.org/@babel/template/-/template-7.27.2.tgz"
@@ -9270,12 +9275,12 @@ jsonfile@^6.0.1:
   optionalDependencies:
     graceful-fs "^4.1.6"
 
-jspdf@^3.0.1, jspdf@^3.0.2:
-  version "3.0.2"
-  resolved "https://registry.npmjs.org/jspdf/-/jspdf-3.0.2.tgz#f1e0e7f0954327bea4b8b02008613ad51e6024f6"
-  integrity sha512-G0fQDJ5fAm6UW78HG6lNXyq09l0PrA1rpNY5i+ly17Zb1fMMFSmS+3lw4cnrAPGyouv2Y0ylujbY2Ieq3DSlKA==
+jspdf@^3.0.1, jspdf@^4.0.0:
+  version "4.0.0"
+  resolved "https://registry.npmjs.org/jspdf/-/jspdf-4.0.0.tgz#3731c0a1a7d8afe28c681891236f8ad4a662d893"
+  integrity sha512-w12U97Z6edKd2tXDn3LzTLg7C7QLJlx0BPfM3ecjK2BckUl9/81vZ+r5gK4/3KQdhAcEZhENUxRhtgYBj75MqQ==
   dependencies:
-    "@babel/runtime" "^7.26.9"
+    "@babel/runtime" "^7.28.4"
     fast-png "^6.2.0"
     fflate "^0.8.1"
   optionalDependencies: