[Snyk] Security upgrade plotly.js from 1.41.3 to 1.49.0

[snyk-bot]

Snyk has created this PR to fix one or more vulnerable packages in the `npm` dependencies of this project.

✨What is Merge Advice?

We check thousands of dependency upgrade pull requests and CI tests every day to see which upgrades were successfully merged. After crunching this data, we give a recommendation on how safe we think the change is for you to merge without causing issues. Learn more, and share your feedback to help improve this feature. 🙏

Changes included in this PR

• Changes to the following files to upgrade the vulnerable dependencies to a fixed version:
  • package.json
  • package-lock.json

Vulnerabilities that will be fixed

With an upgrade:

Severity	Issue	Breaking Change	Exploit Maturity
	Prototype Pollution SNYK-JS-MINIMIST-559764	No	Proof of Concept

Commit messages

Package name: plotly.js

The new version differs by 250 commits.

• dfc06ce 1.49.0
• 9e371f7 update changelog for 1.49.0
• 96fe262 Merge pull request Add option to control whether to format target value. getredash/redash#4063 from plotly/reuse-merge-array-cast-positive
• f9db523 cast bad size values to zero instead of NaN - fixup scattergeo jasmine test
• 39b9840 add jasmine tests to guard against negative sizes during calc step
• 539d7b7 Merge pull request Pin kombu version getredash/redash#4075 from plotly/dev-deps-07-2019
• e61ee25 bump eslint to 6.1.0 + disable `no-prototype-builtins` rule
• e0a17f3 bump dev deps
• cfcf746 run `npm audit fix`
• a9e7480 Merge pull request Counter visualization: formatting not applied to target value getredash/redash#4035 from plotly/mapbox-style-better-docs
• 29c2bf9 improve mapbox layer `source` and `type` descriptions (again)
• 1400437 Merge pull request Fix loading of periodic tasks and clean up extension loading. getredash/redash#4064 from plotly/minor-log-axes-no-suffix-prefix
• cb521f5 improve mock by adding trace names based on their y-axis info
• 27067a6 only skip prefix and suffix for D log axes - improve test
• d81f28c improve mapbox.layers[i] sourcetype and type attr descriptions
• b933528 mprove `mapbox.style` description (take 3)
• 81f9d53 use styleValuesNonMapbox in mapbox.style attr declaration
• a460be0 resolves Change the required Docker Compose version to 3.2 getredash/redash#4059 - throw error msg about "missing style"
• d4a2308 bump mapbox-gl to 1.1.1
• 84e79e4 Merge pull request Move Cypress to dev dependencies getredash/redash#3991 from pynklu/2206-configurable-double-click-delay
• 1b15616 Merge branch 'master' into mapbox-style-better-docs
• 1bebca6 Merge pull request Require a more up-to-date version of importlib-metadata. getredash/redash#4069 from plotly/mapbox-attributions-inject-css
• 1415344 improve doubleClickDelay description
• 4db3809 Merge pull request Fail to build with Docker compose. getredash/redash#4068 from plotly/mapbox-extra-tilesets

See the full diff

Check the changes in this PR to ensure they won't cause issues with your project.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:

🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic