Bump canvas from 2.10.2 to 2.11.2

[dependabot]

Bumps canvas from 2.10.2 to 2.11.2.

Release notes

Sourced from canvas's releases.

v2.11.2

Fixed

• Building on Windows in CI (and maybe other Windows configurations?) (#2216)

v2.11.1

Fixed

• Add missing property canvas to the CanvasRenderingContext2D type
• Fixed glyph positions getting rounded, resulting text having a slight letter-spacing effect
• Fixed ctx.font not being restored correctly after ctx.restore() (#1946)

v2.11.0

Fixed

• Replace triple-slash directive in types with own types to avoid polluting TS modules with globals (#1656)

Changelog

Sourced from canvas's changelog.

2.11.2

Fixed

• Building on Windows in CI (and maybe other Windows configurations?) (#2216)

2.11.1

Fixed

• Add missing property canvas to the CanvasRenderingContext2D type
• Fixed glyph positions getting rounded, resulting text having a slight letter-spacing effect
• Fixed ctx.font not being restored correctly after ctx.restore() (#1946)

2.11.0

Fixed

• Replace triple-slash directive in types with own types to avoid polluting TS modules with globals (#1656)

Commits

• 38e0a32 v2.11.2
• 9910243 fix not compiling on certain windows versions
• 9ecfb70 v2.11.1
• fdf709a move ctx.font string to the state struct
• 4c276e0 fix incorrect text width with newer (1.43?) Pango
• 55d39cb fix macos CI
• 9f313df Add canvas property to CanvasRenderingContext2D type
• fc160f5 v2.11.0
• 40b4382 use tailored types instead of extending DOM
• See full diff in compare view

Maintainer changes

This version was pushed to npm by calebhearon, a new releaser for canvas since your current version.

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[socket-security]

New dependency changes detected. Learn more about Socket for GitHub ↗︎

---

🚨 Potential security issues found in this pull request. To accept the risk, merge this PR and you will not be notified again.

Bot Commands

To ignore an alert, reply with a comment starting with @SocketSecurity ignore followed by a space separated list of package-name@version specifiers. e.g. @SocketSecurity ignore foo@1.0.0 bar@* or ignore all packages with @SocketSecurity ignore-all

• @SocketSecurity ignore canvas@2.11.2

📜 Install scripts

Install scripts are run when the package is installed. The majority of malware in npm is hidden in install scripts.

Packages should not be running non-essential scripts during install and there are often solutions to problems people solve with install scripts that can be run at publish time instead.

Package	Script field	Source
canvas@2.11.2 (upgraded)	install	package-lock.json, package.json

Pull request alert summary

Issue	Status
Install scripts	⚠️ 1 issue
Native code	✅ 0 issues
Bin script shell injection	✅ 0 issues
Unresolved require	✅ 0 issues
Invalid package.json	✅ 0 issues
HTTP dependency	✅ 0 issues
Git dependency	✅ 0 issues
Potential typo squat	✅ 0 issues
Known Malware	✅ 0 issues
Telemetry	✅ 0 issues
Protestware/Troll package	✅ 0 issues

---

📊 Modified Dependency Overview:

⬆️ Updated Package	Version Diff	Capability Access	+/- Transitive Count	Publisher
canvas@2.11.2	2.10.2...2.11.2	filesystem, environment	+0/-0	calebhearon