chartjs/chart.js
Simple HTML5 Charts using the <canvas> tag
How chart.js is put together
Chart.js is a client-side JavaScript/TypeScript charting library that renders charts to HTML5 canvas. The codebase is organized as a modular ESM source tree (src/) with a plugin-style registry architecture: a core controller orchestrates chart lifecycle, while controllers, elements, scales, and plugins register themselves via a typed registry and are resolved through a hierarchical options/default-merging system. Rollup bundles the library into UMD, ESM, and CommonJS distributions (dist/, auto/, helpers/) with TypeScript declaration files emitted separately. There is no backend, datastore, or network layer; data flows from user-supplied config/data objects through option resolution into canvas rendering.
Languages
Frameworks
Infrastructure
Major components
core
Chart lifecycle orchestration, configuration resolution, animations, layouts, interaction/hit detection, scale base class, ticks generation, and the typed plugin/controller registry.
controllers
Dataset-type controllers (bar, bubble, doughnut, line, pie, polarArea, radar, scatter) that map dataset data onto scales and drive element rendering.
elements
Drawable chart primitives (arc, bar, line, point) with their geometry and styling.
scales
Axis implementations: category, linear/logarithmic, radial linear, time, and time-series scales including tick computation.
plugins
Built-in plugins for colors, decimation, legend, title/subtitle, tooltip, and the area filler plugin.
helpers
Utility modules for canvas drawing, color handling, config resolution/proxies, DOM access, math, interpolation, easing, RTL text, and internationalization.
platform
Abstraction over runtime environments: base platform plus basic (non-DOM) and DOM platform implementations.
build/packaging
Rollup-based bundling into UMD/ESM/CJS outputs plus subpath packages auto/ and helpers/ for legacy bundlers.
No digest this week
1 weeksWeek of
Dependencies and code review
Dependency advisories
Security Watch
2 vulnerable packages (3 advisories) across 46 scanned dependencies.
luxon 3.0.1
1 advisory. Fixed in 1.28.1.
How it can be abusedIf a site feeds user-typed date strings through Luxon for parsing or formatting, a crafted string can make the matching code hang the browser tab, freezing the page for everyone viewing it. In this repo that only happens if the app also installs the Luxon chart adapter and renders dates from untrusted input; Chart.js itself does not ship Luxon.
- highGHSA-3xq5-wjfh-ppjcLuxon Inefficient Regular Expression Complexity vulnerability
rollup 3.3.0
2 advisories. Fixed in 3.29.5.
How it can be abusedThe bundler that builds this library can emit code that reads values off the web page by element name, so an attacker who can slip a crafted tag into any page hosting a Chart.js bundle could hijack those values and run script in the visitor's browser. Only sites serving prebuilt Chart.js files produced with this old rollup are exposed, and the file-write flaw does not apply since it affects a later major version.
- highGHSA-gcx4-mw62-g8wmDOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
- highGHSA-mw96-cpmx-2vgcRollup 4 has Arbitrary File Write via Path Traversal
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required