mirror of
https://github.com/toeverything/AFFiNE.git
synced 2026-08-11 05:58:56 +08:00
chore: bump up mermaid version to v11.16.1 [SECURITY] (#15443)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [mermaid](https://redirect.github.com/mermaid-js/mermaid) | [`11.15.0` → `11.16.1`](https://renovatebot.com/diffs/npm/mermaid/11.15.0/11.16.1) |  |  | --- ### Mermaid XY Charts are vulnerable to an infinite loop DoS [CVE-2026-71436](https://nvd.nist.gov/vuln/detail/CVE-2026-71436) / [GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7) <details> <summary>More information</summary> #### Details ##### Impact Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the `setXAxisRangeData()`, when configuring an X-Axis with invalid parameters. As each loop appends an element to an array, this would generally only cause an `RangeError: Invalid array length` to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment. ##### Proof-of-concept ```txt xychart x-axis 1 --> 1 line [1, 2] ``` ##### Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1). A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in [Mermaid v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) ##### Workarounds There are no known workarounds. Please update to the latest version or apply the patch. ##### References - https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 - https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a - https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8 #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289](https://redirect.github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289) - [https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a](https://redirect.github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) - [https://github.com/advisories/GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid Architecture diagrams are vulnerable to prototype pollution [CVE-2026-71437](https://nvd.nist.gov/vuln/detail/CVE-2026-71437) / [GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3) <details> <summary>More information</summary> #### Details Rendering an untrusted `architecture-beta` diagram lets the diagram author write an arbitrary property with the value `horizontal` or `vertical` onto `Object.prototype`. A group id of `__proto__` is accepted as a valid parent. ##### Impact Any code in the same realm that reads a property of that name from an arbitrary object, or enumerates an object with bare `for...in`, observes the injected value (which can only be the string `horizontal` or `vertical`. This may mean corrupted option/config defaults, bypassed truthiness checks, causing denial of service or logic corruption in the embedding application. Because the injected value cannot be an object or function, this is not directly exploitable for remote code execution. ##### PoC ``` architecture-beta group mermaidPrototypePollutionMarker(cloud)[Marker] service a(server)[A] in __proto__ service b(server)[B] in mermaidPrototypePollutionMarker a:R -- L:b ``` The vulnerable write was introduced in commit [cb0a4703bdf01d47508bde1c08aa9a980d70bc20](https://redirect.github.com/mermaid-js/mermaid/commit/cb0a4703bdf01d47508bde1c08aa9a980d70bc20) and first shipped in `mermaid@11.5.0`. The lines are unchanged in every release since. ##### Patches This has been patched by https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf, released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) ##### Workarounds There are no known workarounds. Please update to a patched version. ##### References _Are there any links users can visit to find out more?_ - https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf](https://redirect.github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1) - [https://github.com/advisories/GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid allows CSS injection applying to sibling elements of the diagram [CVE-2026-50159](https://nvd.nist.gov/vuln/detail/CVE-2026-50159) / [GHSA-6x64-9x62-f2gx](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx) <details> <summary>More information</summary> #### Details ##### Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with `#mermaid-X`, sibling (`~` and `+`) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram `<svg>`. **Most users of mermaid would not be affected by this**, as mermaid adds its `<svg>` as an only child of it's parent element. However, you may be affected if you manually insert the `<svg>` (or other elements) into the DOM yourself. ##### Details Mermaid namespaces CSS through with a middleware intended to scope all rules to the diagram's SVG element. CSS nesting expands `& ~ * { ... }` to `#svgId ~ *`, which selects all sibling elements following the SVG in the DOM, outside the diagram boundary. ##### Impact An attacker able to supply diagram source to a page (e.g., user-generated content rendered by Mermaid) could inject CSS rules affecting sibling elements to the diagram `<svg>` on the host page. This can be used for UI redressing, hiding content, conditional CSS-based probing, or phishing-style visual manipulation. JavaScript execution is not possible via this vector. ##### Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed and released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1). A backport has been made for the v10 branch in 7e83f1533318b307764d961906a73377266f4c5e and was released in [Mermaid v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) ##### Workarounds If you are inserting the `<svg>` into the DOM yourself, you can wrap it in an element with no other children, e.g. `<div><svg>...</svg></div>` or `element.innerHTML = svg`. Alternatively, you can use `mermaid.run()` or `mermaid.initialize()` which will do this for you. Setting ["securityLevel": "sandbox"](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will also prevent this, or setting the [`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure) config value in the mermaid config to avoid allowing diagrams to modify `fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`. To test, you can try using a `themeCSS` with `& + * { /* my CSS here */}` and see if it's applied outside of your mermaid `<svg>`. ```mermaid-example --- config: themeCSS: |- & + * { background:red !important; width:100vw !important; height:100vh !important; position:fixed !important; inset:0 !important; } --- info ``` ##### References - GHSA-87f9-hvmw-gh4p/CVE-2026-41159 (related vulnerability) - https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 - https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e - https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8 #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed](https://redirect.github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed) - [https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e](https://redirect.github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) - [https://github.com/advisories/GHSA-6x64-9x62-f2gx](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid configuration APIs allow prototype pollution [CVE-2026-71438](https://nvd.nist.gov/vuln/detail/CVE-2026-71438) / [GHSA-c4c3-pg64-4m4v](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v) <details> <summary>More information</summary> #### Details ##### Summary Mermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig`) merge the caller-supplied configuration object into Mermaid's internal config using the `assignWithDepth` deep-merge helper that is vulnerable to prototype pollution. Because these APIs are intended to receive **trusted** configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as **low**. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage. User-controlled configuration (e.g. configuration in diagram code using `%%{init: {}}%%` or YAML frontmatter) are already protected from prototype pollution. ##### Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1). A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in [Mermaid v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) ##### Impact Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration. ##### Workarounds Don't pass user-controlled data to the `mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` functions. Instead, users can use `%%{init: {}}%%` or YAML frontmatter in diagrams. ##### Reporters - liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/ - ziyue0530@​gmail.com (Ziyue), https://zyy0530.github.io/ - cshe0476@​uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/ - chng0012@​uni.sydney.edu.au (Maurice), http://maurice.busystar.org/ - cyu210608@​gmail.com (Chenchen), https://7thparkk.github.io/ #### Severity - CVSS Score: 2.4 / 10 (Low) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43) - [https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956](https://redirect.github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) - [https://github.com/advisories/GHSA-c4c3-pg64-4m4v](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid radar diagrams are vulnerable to DoS [CVE-2026-71439](https://nvd.nist.gov/vuln/detail/CVE-2026-71439) / [GHSA-rhh3-jpg6-66xh](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh) <details> <summary>More information</summary> #### Details ##### Impact Mermaid radar diagrams allow arbitrary large values for `ticks`, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory. ##### Proof-of-concept ```txt radar-beta axis a, b curve c {1, 1} ticks 1000000000 ``` ##### Patches _Has the problem been patched? What versions should users upgrade to?_ This problem has been patched by https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e, which was released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) ##### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There are no known workarounds without updating to a patched version of mermaid. ##### References _Are there any links users can visit to find out more?_ - https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e](https://redirect.github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) - [https://github.com/advisories/GHSA-rhh3-jpg6-66xh](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>mermaid-js/mermaid (mermaid)</summary> ### [`v11.16.1`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.16.1) ##### Patch Changes - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`12d472c`](https://redirect.github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix: handle CSS sibling combinators in compileCSS - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`2cd6dcf`](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix: increase protections against prototype pollution User-controlled input already has protections against prototype pollution. Fixes: GHSA-c4c3-pg64-4m4v - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`99af3fc`](https://redirect.github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix(architecture): use `Map`s and `Set`s to store groups/services Services are now rendered in the order they are defined and more service IDs are now supported. - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`2cd6dcf`](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - deprecate: Deprecate the `mermaidAPI.setConfig()` function Calling this function has no observable effect, as the next time a `render()` or `parse()` is called, the `currentConfig` is cleared. - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`630aa7e`](https://redirect.github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix(xychart): support zero-width x-axis ranges - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`59b22fa`](https://redirect.github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix(radar): limit number of ticks to 32 Setting a ticks value higher than this would only show 32 ticks. ### [`v11.16.0`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.0) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.16.0) ##### Minor Changes - [#​7535](https://redirect.github.com/mermaid-js/mermaid/pull/7535) [`ea1c48f`](https://redirect.github.com/mermaid-js/mermaid/commit/ea1c48f53fce5d025388d386c90da8743ee25b13) Thanks [@​ragelink](https://redirect.github.com/ragelink)! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as `cynefin-beta`). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design. - [#​7721](https://redirect.github.com/mermaid-js/mermaid/pull/7721) [`f45cc2c`](https://redirect.github.com/mermaid-js/mermaid/commit/f45cc2cc5683b90990e374a463b7bcad0fd68a38) Thanks [@​notionparallax](https://redirect.github.com/notionparallax)! - feat(treeView): add box-drawing character input support for treeView diagrams - [#​7550](https://redirect.github.com/mermaid-js/mermaid/pull/7550) [`f1f4d45`](https://redirect.github.com/mermaid-js/mermaid/commit/f1f4d45ee0513b64a2bd280087d31656f9d2c786) Thanks [@​DominicBurkart](https://redirect.github.com/DominicBurkart)! - feat(xychart): add per-point text labels for xychart line plots - [#​7527](https://redirect.github.com/mermaid-js/mermaid/pull/7527) [`b4d0442`](https://redirect.github.com/mermaid-js/mermaid/commit/b4d0442dd1628acb3f71681519e7f47fc8bacf55) Thanks [@​notionparallax](https://redirect.github.com/notionparallax)! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures. - [#​7793](https://redirect.github.com/mermaid-js/mermaid/pull/7793) [`a6f097d`](https://redirect.github.com/mermaid-js/mermaid/commit/a6f097d580d459dfc3ade3e21030037341f79940) Thanks [@​SSDWGG](https://redirect.github.com/SSDWGG)! - feat(er): support optional ER attribute types with a `?` suffix - [#​7772](https://redirect.github.com/mermaid-js/mermaid/pull/7772) [`37f2e36`](https://redirect.github.com/mermaid-js/mermaid/commit/37f2e36fa017698b66093ac5518396523a7a3241) Thanks [@​devareddy05](https://redirect.github.com/devareddy05)! - feat(gantt): support multiple `excludes` / `includes` lines so long exclusion lists can be split into commented groups ([#​6270](https://redirect.github.com/mermaid-js/mermaid/issues/6270)) - [#​7708](https://redirect.github.com/mermaid-js/mermaid/pull/7708) [`4e63e9d`](https://redirect.github.com/mermaid-js/mermaid/commit/4e63e9d338b6476df283afd4a002072945bc4563) Thanks [@​txmxthy](https://redirect.github.com/txmxthy)! - feat(architecture): add `align row|column {ids…}` directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly. - [#​7760](https://redirect.github.com/mermaid-js/mermaid/pull/7760) [`05223be`](https://redirect.github.com/mermaid-js/mermaid/commit/05223bee47a424be3ba7805e753b96861d342765) Thanks [@​ngdaniels](https://redirect.github.com/ngdaniels)! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice - [#​7251](https://redirect.github.com/mermaid-js/mermaid/pull/7251) [`216e4e9`](https://redirect.github.com/mermaid-js/mermaid/commit/216e4e9a61afceae885b00854f79e17373ccad31) Thanks [@​ydah](https://redirect.github.com/ydah)! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta). - [#​7774](https://redirect.github.com/mermaid-js/mermaid/pull/7774) [`e5c75e6`](https://redirect.github.com/mermaid-js/mermaid/commit/e5c75e6b797f84f8f652d8771eb1ce6161dd8f89) Thanks [@​ngdaniels](https://redirect.github.com/ngdaniels)! - feat(xychart): enable rotate label on X-axis - [#​7791](https://redirect.github.com/mermaid-js/mermaid/pull/7791) [`974fa7b`](https://redirect.github.com/mermaid-js/mermaid/commit/974fa7b7e791b442ad5f7862f1cbecd53d982485) Thanks [@​knsv-bot](https://redirect.github.com/knsv-bot)! - feat(swimlane): add swimlane as a standalone diagram type with a dedicated layered orthogonal layout algorithm ##### Patch Changes - [#​7744](https://redirect.github.com/mermaid-js/mermaid/pull/7744) [`633c261`](https://redirect.github.com/mermaid-js/mermaid/commit/633c261dadbaa20ee0cf9a0299e2269abe4ca573) Thanks [@​ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix(architecture): add `architecture.seed` config option to make architecture diagrams render deterministically. Resolves [#​7729](https://redirect.github.com/mermaid-js/mermaid/issues/7729). - [#​7732](https://redirect.github.com/mermaid-js/mermaid/pull/7732) [`c8ba156`](https://redirect.github.com/mermaid-js/mermaid/commit/c8ba156f551e94dd9a5c30b4971fe83ef3538634) Thanks [@​rkdfx](https://redirect.github.com/rkdfx)! - fix: tolerate leading horizontal whitespace before YAML frontmatter delimiters. Closes [#​7613](https://redirect.github.com/mermaid-js/mermaid/issues/7613) - [#​7314](https://redirect.github.com/mermaid-js/mermaid/pull/7314) [`4e4e6c4`](https://redirect.github.com/mermaid-js/mermaid/commit/4e4e6c4a108d834dd0f643b08deb89159e0eca94) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix(flowchart): Prevent crash when flowchart node shape is undefined - [#​7762](https://redirect.github.com/mermaid-js/mermaid/pull/7762) [`cfd2391`](https://redirect.github.com/mermaid-js/mermaid/commit/cfd23916f3c6b3ceafc4c0cfaf4078f6442bbc4f) Thanks [@​Dharya-dev](https://redirect.github.com/Dharya-dev)! - fix(class): support styling and callbacks for generic classes - [#​7284](https://redirect.github.com/mermaid-js/mermaid/pull/7284) [`c1f116d`](https://redirect.github.com/mermaid-js/mermaid/commit/c1f116d36646786326c596a5f25e519bdaac7748) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix(gantt): Render gantt vertical markers without affecting row layout or chart height - [#​7786](https://redirect.github.com/mermaid-js/mermaid/pull/7786) [`72fbab1`](https://redirect.github.com/mermaid-js/mermaid/commit/72fbab1a4d6efbfa219b13c1639dabcadc754ad8) Thanks [@​knsv-bot](https://redirect.github.com/knsv-bot)! - fix(er): allow special characters (e.g. dots) in ER diagram attribute names and types by escaping them with backticks - [#​7672](https://redirect.github.com/mermaid-js/mermaid/pull/7672) [`4887e97`](https://redirect.github.com/mermaid-js/mermaid/commit/4887e9721c33b5d771306a4e7ab768d78908a157) Thanks [@​sjackson0109](https://redirect.github.com/sjackson0109)! - fix(flowchart): respect per-subgraph direction keyword in Dagre layout. Fixes [#​4648](https://redirect.github.com/mermaid-js/mermaid/issues/4648) - [#​7734](https://redirect.github.com/mermaid-js/mermaid/pull/7734) [`a4c1e50`](https://redirect.github.com/mermaid-js/mermaid/commit/a4c1e507a347256f1f3a42be3feb5b6ddc7257f2) Thanks [@​OfirHaf](https://redirect.github.com/OfirHaf)! - fix(block): read block padding and sanitize config dynamically instead of at module load time - [#​7674](https://redirect.github.com/mermaid-js/mermaid/pull/7674) [`cc75089`](https://redirect.github.com/mermaid-js/mermaid/commit/cc750896b21a2715256ac0de486bafe0351c40c4) Thanks [@​cyphercodes](https://redirect.github.com/cyphercodes)! - fix(block): respect current DOMPurify config when sanitizing labels - [#​7711](https://redirect.github.com/mermaid-js/mermaid/pull/7711) [`be2e282`](https://redirect.github.com/mermaid-js/mermaid/commit/be2e28201445505ec68b1ebf6e3e6813fb6a6898) Thanks [@​Jinacker](https://redirect.github.com/Jinacker)! - fix(flowchart): render flowchart and state self-loop edges as a single SVG path. - [#​7781](https://redirect.github.com/mermaid-js/mermaid/pull/7781) [`d945968`](https://redirect.github.com/mermaid-js/mermaid/commit/d945968c13b154dcf2c89ad1e6ed5104458d32fe) Thanks [@​Dharya-dev](https://redirect.github.com/Dharya-dev)! - fix(radar): align axis labels based on angular position to prevent clipping - [#​7661](https://redirect.github.com/mermaid-js/mermaid/pull/7661) [`2f5e9e8`](https://redirect.github.com/mermaid-js/mermaid/commit/2f5e9e8c9aabb74e61e43428e91217e9585c8d05) Thanks [@​nabila401](https://redirect.github.com/nabila401)! - fix(venn): fix 3-circle venn diagram union rendering - [#​7780](https://redirect.github.com/mermaid-js/mermaid/pull/7780) [`8dcdce4`](https://redirect.github.com/mermaid-js/mermaid/commit/8dcdce40ee091aafd546aa842aca8b4da1e49c1b) Thanks [@​Dharya-dev](https://redirect.github.com/Dharya-dev)! - fix(xychart): truncate plot data to match x-axis category count - [#​7235](https://redirect.github.com/mermaid-js/mermaid/pull/7235) [`1bbc189`](https://redirect.github.com/mermaid-js/mermaid/commit/1bbc189b69be4c50a08ba74501567123769f30bb) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix: Support consecutive LaTeX in node text - [#​7247](https://redirect.github.com/mermaid-js/mermaid/pull/7247) [`365c1b1`](https://redirect.github.com/mermaid-js/mermaid/commit/365c1b1062dd6b5b7c59682f7df6b5c9ed40cd16) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix(treeView): Ensure treemap labels render correctly in large nested diagrams - [#​7754](https://redirect.github.com/mermaid-js/mermaid/pull/7754) [`06a32b7`](https://redirect.github.com/mermaid-js/mermaid/commit/06a32b74fbe574ba36fb77ffd9743a8b884b2f55) Thanks [@​palgunatm66](https://redirect.github.com/palgunatm66)! - fix(sequence): sequenceDiagram rect backgrounds using theme-aware fallback colors - [#​7693](https://redirect.github.com/mermaid-js/mermaid/pull/7693) [`afaf306`](https://redirect.github.com/mermaid-js/mermaid/commit/afaf3062381d115d66744413151b642f124dd9ba) Thanks [@​dull-bird](https://redirect.github.com/dull-bird)! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Fixes [#​7120](https://redirect.github.com/mermaid-js/mermaid/issues/7120). - [#​7751](https://redirect.github.com/mermaid-js/mermaid/pull/7751) [`79e97cd`](https://redirect.github.com/mermaid-js/mermaid/commit/79e97cd7b9cb8f2d9bf6ba6d04de5cdeb4223d1b) Thanks [@​puneetdixit200](https://redirect.github.com/puneetdixit200)! - fix(state): render state diagram click tooltips with mermaidTooltip - [#​7570](https://redirect.github.com/mermaid-js/mermaid/pull/7570) [`c2305df`](https://redirect.github.com/mermaid-js/mermaid/commit/c2305df424963c0263d1c75804248db2969ee17e) Thanks [@​PinguinsRule](https://redirect.github.com/PinguinsRule)! - fix(state): Fix invalid syntax between state and '{' - [#​7758](https://redirect.github.com/mermaid-js/mermaid/pull/7758) [`a4a250b`](https://redirect.github.com/mermaid-js/mermaid/commit/a4a250b96321e0648eecfbadbfb17b1537dff691) Thanks [@​mk24x7](https://redirect.github.com/mk24x7)! - fix(venn): render labeled higher-arity unions when the underlying pairwise unions are not declared. Resolves [#​7656](https://redirect.github.com/mermaid-js/mermaid/issues/7656). - Updated dependencies \[[`ea1c48f`](https://redirect.github.com/mermaid-js/mermaid/commit/ea1c48f53fce5d025388d386c90da8743ee25b13), [`b4d0442`](https://redirect.github.com/mermaid-js/mermaid/commit/b4d0442dd1628acb3f71681519e7f47fc8bacf55), [`4e63e9d`](https://redirect.github.com/mermaid-js/mermaid/commit/4e63e9d338b6476df283afd4a002072945bc4563), [`216e4e9`](https://redirect.github.com/mermaid-js/mermaid/commit/216e4e9a61afceae885b00854f79e17373ccad31)]: - [@​mermaid-js/parser](https://redirect.github.com/mermaid-js/parser)@​1.2.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6ImNhbmFyeSIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This commit is contained in:
renovate[bot]
@@ -3489,7 +3489,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@braintree/sanitize-url@npm:^7.1.1":
|
||||
"@braintree/sanitize-url@npm:^7.1.2":
|
||||
version: 7.1.2
|
||||
resolution: "@braintree/sanitize-url@npm:7.1.2"
|
||||
checksum: 10/d9626ff8f8eb5e192cd055e6e743449c21102c76bb59e405b7028fe56230fa080bfcc80dfb1e21850a6876e75adda9f7b3c888cf0685942bb74da4d2866d6ec3
|
||||
@@ -3605,7 +3605,7 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@chevrotain/types@npm:~11.1.1":
|
||||
"@chevrotain/types@npm:~11.1.2":
|
||||
version: 11.1.2
|
||||
resolution: "@chevrotain/types@npm:11.1.2"
|
||||
checksum: 10/ad39d7651a20b05ead9b4374f98afc39915118dda29678c2b623571aa3da3018a0f3fb799d1809605cafcae59cba637d640855ea0f97b9b01d0900d77d6781fe
|
||||
@@ -7641,12 +7641,12 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"@mermaid-js/parser@npm:^1.1.1":
|
||||
version: 1.1.1
|
||||
resolution: "@mermaid-js/parser@npm:1.1.1"
|
||||
"@mermaid-js/parser@npm:^1.2.0":
|
||||
version: 1.2.0
|
||||
resolution: "@mermaid-js/parser@npm:1.2.0"
|
||||
dependencies:
|
||||
"@chevrotain/types": "npm:~11.1.1"
|
||||
checksum: 10/9f3645fd055c0800c16a3e7eab1ce7f05736c352ab48996e9c64fb21b27c25a5987636040816b1bb16384a4434744cecbdf746c152ef80e0bc712972cb58deed
|
||||
"@chevrotain/types": "npm:~11.1.2"
|
||||
checksum: 10/278ae28edd452c9bcee3723a2d45a6a3f174700cb80fc907b9a5212f2ce449c9a5a6f7d45372bb18b6d633f8040dff4c4d2533b6a3c8d3f021903b3d6ccea799
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -21234,10 +21234,10 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"cytoscape@npm:^3.33.1":
|
||||
version: 3.33.1
|
||||
resolution: "cytoscape@npm:3.33.1"
|
||||
checksum: 10/0e8d3ea87eb624899341d6a765cfb732199af8a871beedeb94971061632ce814c2c39e8257d6628c5611ca9dadc1a723a00377d04f149e0d24f6c133a6ab8647
|
||||
"cytoscape@npm:^3.33.3":
|
||||
version: 3.34.0
|
||||
resolution: "cytoscape@npm:3.34.0"
|
||||
checksum: 10/5bbc169798829b1a0eaadcad2707e7762e7ba1a2bcd5dbeaf75b89eb2d2ab9211e51d96b24c1f5807e329ac44c50913062464e2af11c528a1255969a36b45268
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -21664,10 +21664,10 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"dayjs@npm:^1.11.13, dayjs@npm:^1.11.19":
|
||||
version: 1.11.20
|
||||
resolution: "dayjs@npm:1.11.20"
|
||||
checksum: 10/5347533f21a55b8bb1b1ef559be9b805514c3a8fb7e68b75fb7e73808131c59e70909c073aa44ce8a0d159195cd110cdd4081cf87ab96cb06fee3edacae791c6
|
||||
"dayjs@npm:^1.11.13, dayjs@npm:^1.11.20":
|
||||
version: 1.11.21
|
||||
resolution: "dayjs@npm:1.11.21"
|
||||
checksum: 10/dd16f9f2706b61b90e3c346a3211ac3afd9e26193136ce0e87f70bf74d1c17a447bceb230a88b175467fc9f5e3243d8c1544b9897092a12d9c80ee44d338dcb6
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -22076,15 +22076,15 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"dompurify@npm:^3.3.1, dompurify@npm:^3.4.11":
|
||||
version: 3.4.12
|
||||
resolution: "dompurify@npm:3.4.12"
|
||||
"dompurify@npm:^3.3.3, dompurify@npm:^3.4.11":
|
||||
version: 3.4.13
|
||||
resolution: "dompurify@npm:3.4.13"
|
||||
dependencies:
|
||||
"@types/trusted-types": "npm:^2.0.7"
|
||||
dependenciesMeta:
|
||||
"@types/trusted-types":
|
||||
optional: true
|
||||
checksum: 10/f826b68920887eb75115a162facb42380d1c3fac441548217b30068c9fadeed14f63fa1f7a1d2ab6f63613e5a0f897aa245c9224d4abf7939cd8ae58c04646af
|
||||
checksum: 10/0db0a309a868a38aca042f606b37446977c35ee4501850a8c1bf2781337d79871daf1f4344bbf5b545f2a8c62e4d4e192c8fd6f1ff49ecec7c865c55a0aefee3
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -26536,14 +26536,14 @@ __metadata:
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
"katex@npm:^0.16.0, katex@npm:^0.16.25, katex@npm:^0.16.27":
|
||||
version: 0.16.38
|
||||
resolution: "katex@npm:0.16.38"
|
||||
"katex@npm:^0.16.0, katex@npm:^0.16.27, katex@npm:^0.16.45":
|
||||
version: 0.16.47
|
||||
resolution: "katex@npm:0.16.47"
|
||||
dependencies:
|
||||
commander: "npm:^8.3.0"
|
||||
bin:
|
||||
katex: cli.js
|
||||
checksum: 10/e9103def114d9d08ab216864e66b68e6f50a6360fdc5aa29d8edeee430e1618dd7551b9f080e9c591b3ee24c18fe6910b8fe0c89c7c4b1109abd2b63e223fbc5
|
||||
checksum: 10/e0286b45d9e0c8443cf0381205619ecbab3919ea5fb6616408f46f0cb471ce2222e83f46aef52cdaacdcbfd4485e00fcfbcf36bd85a8a9a81e22b45827c27ced
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
@@ -27851,31 +27851,31 @@ __metadata:
|
||||
linkType: hard
|
||||
|
||||
"mermaid@npm:^11.15.0":
|
||||
version: 11.15.0
|
||||
resolution: "mermaid@npm:11.15.0"
|
||||
version: 11.16.1
|
||||
resolution: "mermaid@npm:11.16.1"
|
||||
dependencies:
|
||||
"@braintree/sanitize-url": "npm:^7.1.1"
|
||||
"@braintree/sanitize-url": "npm:^7.1.2"
|
||||
"@iconify/utils": "npm:^3.0.2"
|
||||
"@mermaid-js/parser": "npm:^1.1.1"
|
||||
"@mermaid-js/parser": "npm:^1.2.0"
|
||||
"@types/d3": "npm:^7.4.3"
|
||||
"@upsetjs/venn.js": "npm:^2.0.0"
|
||||
cytoscape: "npm:^3.33.1"
|
||||
cytoscape: "npm:^3.33.3"
|
||||
cytoscape-cose-bilkent: "npm:^4.1.0"
|
||||
cytoscape-fcose: "npm:^2.2.0"
|
||||
d3: "npm:^7.9.0"
|
||||
d3-sankey: "npm:^0.12.3"
|
||||
dagre-d3-es: "npm:7.0.14"
|
||||
dayjs: "npm:^1.11.19"
|
||||
dompurify: "npm:^3.3.1"
|
||||
dayjs: "npm:^1.11.20"
|
||||
dompurify: "npm:^3.3.3"
|
||||
es-toolkit: "npm:^1.45.1"
|
||||
katex: "npm:^0.16.25"
|
||||
katex: "npm:^0.16.45"
|
||||
khroma: "npm:^2.1.0"
|
||||
marked: "npm:^16.3.0"
|
||||
roughjs: "npm:^4.6.6"
|
||||
stylis: "npm:^4.3.6"
|
||||
ts-dedent: "npm:^2.2.0"
|
||||
uuid: "npm:^11.1.0 || ^12 || ^13 || ^14.0.0"
|
||||
checksum: 10/4a3f8ac77aba326c96adc2325f550421b6f05f1592998fcf80dfeb9fbcd751e2a0a030092559bd258e45bba60c0ad1e7415ad46ff5c165b1d9a469835e927e9a
|
||||
checksum: 10/cd372598789afb5db49b51ae8746b212de798b79760c17384696df2b7fe4eebb2863dc915a13c742f74267bbe9afbffcb6c9ae371e4c5596176cf57ee050d9c8
|
||||
languageName: node
|
||||
linkType: hard
|
||||
|
||||
|
||||
Reference in New Issue
Block a user