fix(deps): update dependency mathjs to v15 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mathjs (source)	^14.2.1 → ^15.0.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

mathjs Allows Improperly Controlled Modification of Dynamically-Determined Object Attributes

CVE-2026-41139 / GHSA-jvff-x2qm-6286

More information

Details

Impact

This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

Patches

The issue was introduced in mathjs v13.1.0, and patched in mathjs v15.2.0.

Workarounds

There is no workaround without upgrading to v15.2.0.

References

You can find out more via the commit fixing this issue: josdejong/mathjs@24d5ee7 (part of PR https://github.com/josdejong/mathjs/pull/3656).

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/josdejong/mathjs/security/advisories/GHSA-jvff-x2qm-6286
• https://github.com/josdejong/mathjs/pull/3656
• https://github.com/josdejong/mathjs/commit/0aee2f61866e35ffa0aef915221cdf6b026ffdd4
• https://github.com/josdejong/mathjs/releases/tag/v15.2.0
• https://github.com/josdejong/mathjs/commit/bcf0da46f0b8577ec03c9ecd7bff8b5c2543a611
• https://github.com/josdejong/mathjs/security/advisories/GHSA-5v89-rwgr-qj6g
• https://nvd.nist.gov/vuln/detail/CVE-2026-41139
• https://github.com/advisories/GHSA-jvff-x2qm-6286

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Unsafe object property setter in mathjs

CVE-2026-40897 / GHSA-29qv-4j9f-fjw5

More information

Details

Impact

This security vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser.

Patches

The issue was introduced in mathjs v13.1.1, and patched in mathjs v15.2.0.

Workarounds

There is no workaround without upgrading to v15.2.0.

References

You can find out more via the commit fixing this issue: josdejong/mathjs@513ab2a (part of PR https://github.com/josdejong/mathjs/pull/3656).

Severity

• CVSS Score: 8.8 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

• https://github.com/josdejong/mathjs/security/advisories/GHSA-29qv-4j9f-fjw5
• https://github.com/josdejong/mathjs/pull/3656
• https://github.com/josdejong/mathjs/commit/513ab2a0e01004af91b31aada68fae8a821326ad
• https://nvd.nist.gov/vuln/detail/CVE-2026-40897
• https://github.com/advisories/GHSA-29qv-4j9f-fjw5

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

josdejong/mathjs (mathjs)

v15.2.0

Compare Source

• Feat: Add amp-hour charge unit Ah (#​3617). Thanks @​adrfantini.
• Feat: #​3595 implement num and den functions returning the parts of
  a fraction (#​3605). Thanks @​AnslemHack.
• Fix: Provide TypeScript types for [and/or]TransformDependencies (#​3639).
  Thanks @​NilsDietrich.
• Fix: two security vulnerabilities that allowed executing arbitrary JavaScript
  via the expression parser. Thanks @​CykuTW for finding and reporting them.

v15.1.1

Compare Source

• Fix: #​3631 Handle bigints in compareNatural (#​3632). Thanks @​Dheemanth07.
• Fix: #​3578 interpret empty true-expr of conditional as error (#​3581).
  Thanks @​gwhitney.
• Fix: #​3597 added nullish type definitions (#​3601). Thanks @​Ayo1984.
• Docs: Correct several arithmetic and relational documentation examples
  and add History (#​3630). Thanks @​Anadian.
• Docs: fix #​3565, update Matrix documentation (#​3591). Thanks @​orelbn.
• Docs: #​3341 add per-function HISTORY sections (#​3606). Thanks @​gwhitney.
• Docs: describe that setDistinct sorts the elements (see #​3602).

v15.1.0

Compare Source

• Fix: #​3578 interpret empty true-expr of conditional as error (#​3581).
  Thanks @​gwhitney.
• Docs: fix #​3565, update Matrix documentation (#​3591). Thanks @​orelbn.

v15.0.0

Compare Source

!!! BE CAREFUL: BREAKING CHANGES !!!

• Feat: #​3349 Decouple precedence of unary percentage operator and binary
  modulus operator (that both use symbol %), and raise the former (#​3432).
  Thanks @​kiprobinsonknack.
• Feat: #​1753 enhance Kronecker product to handle arbitrary dimension (#​3461,
  #​3455). Thanks @​gwhitney and @​Delaney.
• Feat: #​2344 matrix subset according to the type of input (#​3485).
  Thanks @​dvd101x.
• Fix: #​3501 parse % as unary only when not followed by a term (#​3505).
  Thanks @​gwhitney.
• Fix: #​3421 require a space or delimiter after hex, bin, and oct values (#​3463).
• Fix: #​3529 Change function size to always return an Array (#​3535).
• Fix: #​3530 throw an error when trying to flatten a SparseMatrix (#​3536).

v14.9.1

Compare Source

• Fix: issue in HISTORY.md listing all fixes of v14.8.2 under v14.9.0.

v14.9.0

Compare Source

• Feat: improve the performance of map with multiple arguments (#​3526).
  Thanks @​dvd101x.
• Fix: #​3541 throw an error when evaluating a range with a step of zero
  (#​3548). Thanks @​dvd101x.

v14.8.2

Compare Source

• Fix: improve performance in functions like map when passing a unary
  function (#​3546). Thanks @​dvd101x.
• Fix: improve the type definition of abs(complex) which returns a number
  (#​3543). Thanks @​joshkel.
• Fix: add missing type definitions for ctranspose (#​3545). Thanks @​joshkel.
• Fix: typos in code comments (#​3544). Thanks @​joshkel.

v14.8.1

Compare Source

• Fix: #​3538 config printing a warning when using { number: 'bigint' }
  (#​3540).

v14.8.0

Compare Source

• Feat: #​3353 support for the nullish coalescing operator ?? in the
  expression parser (#​3497). Thanks @​ikemHood.

v14.7.0

Compare Source

• Feat: faster DenseMatrix symbol iterator (#​3521). Thanks @​dvd101x.
• Feat: implement serialization support for Parser, fixing #​3509 (#​3525).
• Fix: #​3519, #​3368 categories "Core functions" and "Construction functions"
  missing from the generated function overview.
• Fix: #​3517 printTransformDependencies not exported in the type definitions.
• Fix: add missing type definition for function diff (#​3520). Thanks @​dodokw.
• Fix: #​3396 improve documentation of function range.
• Fix: #​3523 cleanup old polyfills from the browser bundle
  by removing core-js (#​3524).

v14.6.0

Compare Source

• Feat: new function toBest(unit, unitList, offset), and corresponding
  method unit.toBest(...) (#​3484). Thanks @​Mundi93, @​EliaAlesiani, and
  @​HeavyRainLQ.
• Fix: #​3512 sign of zero not returning zero in case of a fraction (#​3513).
  Thanks @​kyle-compute.

---

Configuration

📅 Schedule: (in timezone America/Vancouver)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

---

Thanks for the PR!

Deployments, as required, will be available below:

• Frontend
• Backend

Please create PRs in draft mode. Mark as ready to enable:

• Analysis Workflow

After merge, new images are deployed in:

• Merge Workflow

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.