highcharts · PaulDalek · Nov 15, 2024 · Nov 15, 2024 · Feb 10, 2025 · Feb 10, 2025
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# 4.0.3
+
+_Fixes:_
+
+- Limited the the Access-Control-Allow-Methods CORS header to 'POST', 'GET' and 'OPTIONS'.
+
 # 4.0.2
 
 _Hotfix_:

diff --git a/dist/index.cjs b/dist/index.cjs
diff --git a/dist/index.esm.js b/dist/index.esm.js
diff --git a/dist/index.esm.js.map b/dist/index.esm.js.map
diff --git a/lib/highcharts.js b/lib/highcharts.js
@@ -124,11 +124,7 @@ export async function triggerExport(chartOptions, options, displayErrors) {
   let constr = options.export.constr || 'chart';
   constr = typeof Highcharts[constr] !== 'undefined' ? constr : 'chart';
 
-  Highcharts[constr](
-    'container',
-    finalOptions,
-    finalCallback
-  );
+  Highcharts[constr]('container', finalOptions, finalCallback);
 
   // Get the current global options
   const defaultOptions = getOptions();

diff --git a/lib/server/server.js b/lib/server/server.js
@@ -43,7 +43,11 @@ const app = express();
 app.disable('x-powered-by');
 
 // Enable CORS support
-app.use(cors());
+app.use(
+  cors({
+    methods: ['POST', 'GET', 'OPTIONS']
+  })
+);
 
 // Getting a lot of RangeNotSatisfiableError exception.
 // Even though this is a deprecated options, let's try to set it to false.

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -3,7 +3,7 @@
   "author": "Highsoft AS <[email protected]> (http://www.highcharts.com/about)",
   "license": "MIT",
   "type": "module",
-  "version": "4.0.2",
+  "version": "4.0.3",
   "main": "./dist/index.esm.js",
   "engines": {
     "node": ">=18.12.0"