From 88868c1bd2d3eaa6085f538263f879c7ac7766ec Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Wed, 23 Sep 2026 10:18:33 +0200 Subject: [PATCH 1/2] ref(deps): Patch zrender to clear nodes with textContent zrender's canvas and SVG painters clear their root and helper nodes by assigning to innerHTML. Assigning to innerHTML is a Trusted Types injection sink, so every chart render and dispose is rejected on a page that sets `require-trusted-types-for 'script'`. All seven writes assign an empty string, so textContent is equivalent and clears the node the same way. The remaining innerHTML in svg-legacy/Painter.js is a read, not a write, and is left alone. Submitted upstream as ecomfe/zrender#1167. Patching locally until it lands, since charts are unusable under enforcement without it. --- package.json | 3 +- patches/zrender@6.1.0.patch | 83 +++++++++++++++++++++++++++++++++++++ pnpm-lock.yaml | 9 ++-- 3 files changed, 91 insertions(+), 4 deletions(-) create mode 100644 patches/zrender@6.1.0.patch diff --git a/package.json b/package.json index 9ccb95a2a86e..4e3cf790edea 100644 --- a/package.json +++ b/package.json @@ -343,7 +343,8 @@ ], "patchedDependencies": { "zod@4.3.5": "patches/zod@4.3.5.patch", - "jsdom@30.1.0": "patches/jsdom@30.1.0.patch" + "jsdom@30.1.0": "patches/jsdom@30.1.0.patch", + "zrender@6.1.0": "patches/zrender@6.1.0.patch" } }, "APIMethod": "stub", diff --git a/patches/zrender@6.1.0.patch b/patches/zrender@6.1.0.patch new file mode 100644 index 000000000000..73289fbd661b --- /dev/null +++ b/patches/zrender@6.1.0.patch @@ -0,0 +1,83 @@ +diff --git a/lib/canvas/Painter.js b/lib/canvas/Painter.js +index 78dc6c8d46eca79366f5190a7c191410f8133816..3c79bc4e8abc8917458a0297159c5a0a307b01c8 100644 +--- a/lib/canvas/Painter.js ++++ b/lib/canvas/Painter.js +@@ -111,7 +111,7 @@ var CanvasPainter = (function () { + var rootStyle = root.style; + if (rootStyle) { + util.disableUserSelect(root); +- root.innerHTML = ''; ++ root.textContent = ''; + } + this.storage = storage; + this._prevDisplayList = []; +@@ -685,7 +685,7 @@ var CanvasPainter = (function () { + }); + }; + CanvasPainter.prototype.dispose = function () { +- this.root.innerHTML = ''; ++ this.root.textContent = ''; + this.root = + this.storage = + this._domRoot = +diff --git a/lib/svg/Painter.js b/lib/svg/Painter.js +index 2db019c7e9ac4b13947d0bb9220fdecbfa591d2f..b514a95dd529b76e1bea37953dfd00ed065f4b5a 100644 +--- a/lib/svg/Painter.js ++++ b/lib/svg/Painter.js +@@ -187,7 +187,7 @@ var SVGPainter = (function () { + }; + SVGPainter.prototype.dispose = function () { + if (this.root) { +- this.root.innerHTML = ''; ++ this.root.textContent = ''; + } + this._svgDom = + this._viewport = +@@ -198,7 +198,7 @@ var SVGPainter = (function () { + }; + SVGPainter.prototype.clear = function () { + if (this._svgDom) { +- this._svgDom.innerHTML = null; ++ this._svgDom.textContent = ''; + } + this._oldVNode = null; + }; +diff --git a/lib/svg-legacy/Painter.js b/lib/svg-legacy/Painter.js +index 5ca3b0d2fb308a7e9019a5dcb0869ce05ea130db..a818d6be22e8fa7c35634841d02eefd503a24828 100644 +--- a/lib/svg-legacy/Painter.js ++++ b/lib/svg-legacy/Painter.js +@@ -258,7 +258,7 @@ var SVGPainter = (function () { + return this._height; + }; + SVGPainter.prototype.dispose = function () { +- this.root.innerHTML = ''; ++ this.root.textContent = ''; + this._svgRoot = + this._backgroundRoot = + this._svgDom = +diff --git a/lib/svg-legacy/helper/ClippathManager.js b/lib/svg-legacy/helper/ClippathManager.js +index d99b65aeec73c96cb3d981a87752467819757517..1383275a0c58c5e86ec029eb05a4eaf18ad5ef44 100644 +--- a/lib/svg-legacy/helper/ClippathManager.js ++++ b/lib/svg-legacy/helper/ClippathManager.js +@@ -73,7 +73,7 @@ var ClippathManager = (function (_super) { + } + path.brush(clipPath); + var pathEl = this.getSvgElement(clipPath); +- clipPathEl.innerHTML = ''; ++ clipPathEl.textContent = ''; + clipPathEl.appendChild(pathEl); + parentEl.setAttribute('clip-path', getIdURL(id)); + if (clipPaths.length > 1) { +diff --git a/lib/svg-legacy/helper/GradientManager.js b/lib/svg-legacy/helper/GradientManager.js +index 7d413a137ebdc956c646e293820a745812b98a15..e802f747bae4e6b94271bb840958ee883047f55e 100644 +--- a/lib/svg-legacy/helper/GradientManager.js ++++ b/lib/svg-legacy/helper/GradientManager.js +@@ -96,7 +96,7 @@ var GradientManager = (function (_super) { + dom.setAttribute('gradientUnits', gradient.global + ? 'userSpaceOnUse' + : 'objectBoundingBox'); +- dom.innerHTML = ''; ++ dom.textContent = ''; + var colors = gradient.colorStops; + for (var i = 0, len = colors.length; i < len; ++i) { + var stop_1 = createElement('stop'); diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index a12d5d1576a8..1a42e4143429 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -18,6 +18,9 @@ patchedDependencies: zod@4.3.5: hash: 2bb6d33b2c713a7a2c559c18ad0aa6cfb261f01d935ee1288dfec6c84411aa76 path: patches/zod@4.3.5.patch + zrender@6.1.0: + hash: a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d + path: patches/zrender@6.1.0.patch importers: @@ -532,7 +535,7 @@ importers: version: 4.3.5(patch_hash=2bb6d33b2c713a7a2c559c18ad0aa6cfb261f01d935ee1288dfec6c84411aa76) zrender: specifier: 6.1.0 - version: 6.1.0 + version: 6.1.0(patch_hash=a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d) zxcvbn: specifier: ^4.4.2 version: 4.4.2 @@ -14178,7 +14181,7 @@ snapshots: echarts@6.1.0: dependencies: tslib: 2.3.0 - zrender: 6.1.0 + zrender: 6.1.0(patch_hash=a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d) editorconfig@3.0.2: dependencies: @@ -19155,7 +19158,7 @@ snapshots: zod@4.4.3: {} - zrender@6.1.0: + zrender@6.1.0(patch_hash=a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d): dependencies: tslib: 2.3.0 From fa3ae11ed5e8a5cc9bf02509bc52fb30c6d5b43e Mon Sep 17 00:00:00 2001 From: Alexander Tarasov Date: Wed, 23 Sep 2026 16:26:12 +0200 Subject: [PATCH 2/2] ref(deps): Explain the zrender patch in its header Says what the patch does, why it exists, when to drop it, and why the upstream PR cannot be used verbatim: it edits src/*.ts, while the published package resolves its module entry through index.js to lib/*.js, so the compiled output is what has to be patched. --- patches/zrender@6.1.0.patch | 13 +++++++++++++ pnpm-lock.yaml | 8 ++++---- 2 files changed, 17 insertions(+), 4 deletions(-) diff --git a/patches/zrender@6.1.0.patch b/patches/zrender@6.1.0.patch index 73289fbd661b..ca92f347c8c8 100644 --- a/patches/zrender@6.1.0.patch +++ b/patches/zrender@6.1.0.patch @@ -1,3 +1,16 @@ +Subject: use textContent instead of innerHTML to clear elements + +Assigning to innerHTML is a Trusted Types injection sink, rejected even when +the value is an empty string. textContent = '' clears children identically and +is not a sink, so charts keep working under require-trusted-types-for 'script'. + +Submitted upstream as https://github.com/ecomfe/zrender/pull/1167. Drop this +patch once that lands and we pick up a release containing it. + +Note the upstream PR edits src/*.ts, which cannot replace this patch: the +published package resolves its `module` entry through index.js to lib/*.js, so +the compiled output is what the bundler sees and what has to be patched here. +--- diff --git a/lib/canvas/Painter.js b/lib/canvas/Painter.js index 78dc6c8d46eca79366f5190a7c191410f8133816..3c79bc4e8abc8917458a0297159c5a0a307b01c8 100644 --- a/lib/canvas/Painter.js diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 1a42e4143429..e0d6c836ca0d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -19,7 +19,7 @@ patchedDependencies: hash: 2bb6d33b2c713a7a2c559c18ad0aa6cfb261f01d935ee1288dfec6c84411aa76 path: patches/zod@4.3.5.patch zrender@6.1.0: - hash: a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d + hash: 183ccabb66e5590ca8a810519f1df210e5a87bb8e48b4bae25e76a619954a193 path: patches/zrender@6.1.0.patch importers: @@ -535,7 +535,7 @@ importers: version: 4.3.5(patch_hash=2bb6d33b2c713a7a2c559c18ad0aa6cfb261f01d935ee1288dfec6c84411aa76) zrender: specifier: 6.1.0 - version: 6.1.0(patch_hash=a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d) + version: 6.1.0(patch_hash=183ccabb66e5590ca8a810519f1df210e5a87bb8e48b4bae25e76a619954a193) zxcvbn: specifier: ^4.4.2 version: 4.4.2 @@ -14181,7 +14181,7 @@ snapshots: echarts@6.1.0: dependencies: tslib: 2.3.0 - zrender: 6.1.0(patch_hash=a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d) + zrender: 6.1.0(patch_hash=183ccabb66e5590ca8a810519f1df210e5a87bb8e48b4bae25e76a619954a193) editorconfig@3.0.2: dependencies: @@ -19158,7 +19158,7 @@ snapshots: zod@4.4.3: {} - zrender@6.1.0(patch_hash=a5b5e574364a10d3bbfef07def8f1f327eb54709ca887b1b9681bf949df0f89d): + zrender@6.1.0(patch_hash=183ccabb66e5590ca8a810519f1df210e5a87bb8e48b4bae25e76a619954a193): dependencies: tslib: 2.3.0