mirror of
https://github.com/toeverything/AFFiNE.git
synced 2026-08-12 14:40:22 +08:00
renovate[bot]
7bc349c4de
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [mermaid](https://redirect.github.com/mermaid-js/mermaid) | [`11.15.0` → `11.16.1`](https://renovatebot.com/diffs/npm/mermaid/11.15.0/11.16.1) |  |  | --- ### Mermaid XY Charts are vulnerable to an infinite loop DoS [CVE-2026-71436](https://nvd.nist.gov/vuln/detail/CVE-2026-71436) / [GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7) <details> <summary>More information</summary> #### Details ##### Impact Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the `setXAxisRangeData()`, when configuring an X-Axis with invalid parameters. As each loop appends an element to an array, this would generally only cause an `RangeError: Invalid array length` to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment. ##### Proof-of-concept ```txt xychart x-axis 1 --> 1 line [1, 2] ``` ##### Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1). A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in [Mermaid v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) ##### Workarounds There are no known workarounds. Please update to the latest version or apply the patch. ##### References - https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 - https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a - https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8 #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289](https://redirect.github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289) - [https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a](https://redirect.github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) - [https://github.com/advisories/GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid Architecture diagrams are vulnerable to prototype pollution [CVE-2026-71437](https://nvd.nist.gov/vuln/detail/CVE-2026-71437) / [GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3) <details> <summary>More information</summary> #### Details Rendering an untrusted `architecture-beta` diagram lets the diagram author write an arbitrary property with the value `horizontal` or `vertical` onto `Object.prototype`. A group id of `__proto__` is accepted as a valid parent. ##### Impact Any code in the same realm that reads a property of that name from an arbitrary object, or enumerates an object with bare `for...in`, observes the injected value (which can only be the string `horizontal` or `vertical`. This may mean corrupted option/config defaults, bypassed truthiness checks, causing denial of service or logic corruption in the embedding application. Because the injected value cannot be an object or function, this is not directly exploitable for remote code execution. ##### PoC ``` architecture-beta group mermaidPrototypePollutionMarker(cloud)[Marker] service a(server)[A] in __proto__ service b(server)[B] in mermaidPrototypePollutionMarker a:R -- L:b ``` The vulnerable write was introduced in commit [cb0a4703bdf01d47508bde1c08aa9a980d70bc20](https://redirect.github.com/mermaid-js/mermaid/commit/cb0a4703bdf01d47508bde1c08aa9a980d70bc20) and first shipped in `mermaid@11.5.0`. The lines are unchanged in every release since. ##### Patches This has been patched by https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf, released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) ##### Workarounds There are no known workarounds. Please update to a patched version. ##### References _Are there any links users can visit to find out more?_ - https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 #### Severity - CVSS Score: 6.5 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf](https://redirect.github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1) - [https://github.com/advisories/GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid allows CSS injection applying to sibling elements of the diagram [CVE-2026-50159](https://nvd.nist.gov/vuln/detail/CVE-2026-50159) / [GHSA-6x64-9x62-f2gx](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx) <details> <summary>More information</summary> #### Details ##### Summary Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with `#mermaid-X`, sibling (`~` and `+`) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram `<svg>`. **Most users of mermaid would not be affected by this**, as mermaid adds its `<svg>` as an only child of it's parent element. However, you may be affected if you manually insert the `<svg>` (or other elements) into the DOM yourself. ##### Details Mermaid namespaces CSS through with a middleware intended to scope all rules to the diagram's SVG element. CSS nesting expands `& ~ * { ... }` to `#svgId ~ *`, which selects all sibling elements following the SVG in the DOM, outside the diagram boundary. ##### Impact An attacker able to supply diagram source to a page (e.g., user-generated content rendered by Mermaid) could inject CSS rules affecting sibling elements to the diagram `<svg>` on the host page. This can be used for UI redressing, hiding content, conditional CSS-based probing, or phishing-style visual manipulation. JavaScript execution is not possible via this vector. ##### Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed and released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1). A backport has been made for the v10 branch in 7e83f1533318b307764d961906a73377266f4c5e and was released in [Mermaid v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) ##### Workarounds If you are inserting the `<svg>` into the DOM yourself, you can wrap it in an element with no other children, e.g. `<div><svg>...</svg></div>` or `element.innerHTML = svg`. Alternatively, you can use `mermaid.run()` or `mermaid.initialize()` which will do this for you. Setting ["securityLevel": "sandbox"](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will also prevent this, or setting the [`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure) config value in the mermaid config to avoid allowing diagrams to modify `fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`. To test, you can try using a `themeCSS` with `& + * { /* my CSS here */}` and see if it's applied outside of your mermaid `<svg>`. ```mermaid-example --- config: themeCSS: |- & + * { background:red !important; width:100vw !important; height:100vh !important; position:fixed !important; inset:0 !important; } --- info ``` ##### References - GHSA-87f9-hvmw-gh4p/CVE-2026-41159 (related vulnerability) - https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 - https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e - https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8 #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed](https://redirect.github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed) - [https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e](https://redirect.github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) - [https://github.com/advisories/GHSA-6x64-9x62-f2gx](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid configuration APIs allow prototype pollution [CVE-2026-71438](https://nvd.nist.gov/vuln/detail/CVE-2026-71438) / [GHSA-c4c3-pg64-4m4v](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v) <details> <summary>More information</summary> #### Details ##### Summary Mermaid's configuration setters (`mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig`) merge the caller-supplied configuration object into Mermaid's internal config using the `assignWithDepth` deep-merge helper that is vulnerable to prototype pollution. Because these APIs are intended to receive **trusted** configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as **low**. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage. User-controlled configuration (e.g. configuration in diagram code using `%%{init: {}}%%` or YAML frontmatter) are already protected from prototype pollution. ##### Patches This has been patched in https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43 and released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1). A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in [Mermaid v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) ##### Impact Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration. ##### Workarounds Don't pass user-controlled data to the `mermaid.initialize`, `mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` functions. Instead, users can use `%%{init: {}}%%` or YAML frontmatter in diagrams. ##### Reporters - liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/ - ziyue0530@​gmail.com (Ziyue), https://zyy0530.github.io/ - cshe0476@​uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/ - chng0012@​uni.sydney.edu.au (Maurice), http://maurice.busystar.org/ - cyu210608@​gmail.com (Chenchen), https://7thparkk.github.io/ #### Severity - CVSS Score: 2.4 / 10 (Low) - Vector String: `CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43) - [https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956](https://redirect.github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8) - [https://github.com/advisories/GHSA-c4c3-pg64-4m4v](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid radar diagrams are vulnerable to DoS [CVE-2026-71439](https://nvd.nist.gov/vuln/detail/CVE-2026-71439) / [GHSA-rhh3-jpg6-66xh](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh) <details> <summary>More information</summary> #### Details ##### Impact Mermaid radar diagrams allow arbitrary large values for `ticks`, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory. ##### Proof-of-concept ```txt radar-beta axis a, b curve c {1, 1} ticks 1000000000 ``` ##### Patches _Has the problem been patched? What versions should users upgrade to?_ This problem has been patched by https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e, which was released in [Mermaid v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) ##### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ There are no known workarounds without updating to a patched version of mermaid. ##### References _Are there any links users can visit to find out more?_ - https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e - https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh) - [https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) - [https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e](https://redirect.github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) - [https://github.com/advisories/GHSA-rhh3-jpg6-66xh](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh) This data is provided by the [GitHub Advisory Database](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh) ([CC-BY 4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>mermaid-js/mermaid (mermaid)</summary> ### [`v11.16.1`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.16.1) ##### Patch Changes - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`12d472c`](https://redirect.github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix: handle CSS sibling combinators in compileCSS - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`2cd6dcf`](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix: increase protections against prototype pollution User-controlled input already has protections against prototype pollution. Fixes: GHSA-c4c3-pg64-4m4v - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`99af3fc`](https://redirect.github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix(architecture): use `Map`s and `Set`s to store groups/services Services are now rendered in the order they are defined and more service IDs are now supported. - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`2cd6dcf`](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - deprecate: Deprecate the `mermaidAPI.setConfig()` function Calling this function has no observable effect, as the next time a `render()` or `parse()` is called, the `currentConfig` is cleared. - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`630aa7e`](https://redirect.github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix(xychart): support zero-width x-axis ranges - [#​8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022) [`59b22fa`](https://redirect.github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e) Thanks [@​aloisklink](https://redirect.github.com/aloisklink)! - fix(radar): limit number of ticks to 32 Setting a ticks value higher than this would only show 32 ticks. ### [`v11.16.0`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.0) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.16.0) ##### Minor Changes - [#​7535](https://redirect.github.com/mermaid-js/mermaid/pull/7535) [`ea1c48f`](https://redirect.github.com/mermaid-js/mermaid/commit/ea1c48f53fce5d025388d386c90da8743ee25b13) Thanks [@​ragelink](https://redirect.github.com/ragelink)! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as `cynefin-beta`). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design. - [#​7721](https://redirect.github.com/mermaid-js/mermaid/pull/7721) [`f45cc2c`](https://redirect.github.com/mermaid-js/mermaid/commit/f45cc2cc5683b90990e374a463b7bcad0fd68a38) Thanks [@​notionparallax](https://redirect.github.com/notionparallax)! - feat(treeView): add box-drawing character input support for treeView diagrams - [#​7550](https://redirect.github.com/mermaid-js/mermaid/pull/7550) [`f1f4d45`](https://redirect.github.com/mermaid-js/mermaid/commit/f1f4d45ee0513b64a2bd280087d31656f9d2c786) Thanks [@​DominicBurkart](https://redirect.github.com/DominicBurkart)! - feat(xychart): add per-point text labels for xychart line plots - [#​7527](https://redirect.github.com/mermaid-js/mermaid/pull/7527) [`b4d0442`](https://redirect.github.com/mermaid-js/mermaid/commit/b4d0442dd1628acb3f71681519e7f47fc8bacf55) Thanks [@​notionparallax](https://redirect.github.com/notionparallax)! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures. - [#​7793](https://redirect.github.com/mermaid-js/mermaid/pull/7793) [`a6f097d`](https://redirect.github.com/mermaid-js/mermaid/commit/a6f097d580d459dfc3ade3e21030037341f79940) Thanks [@​SSDWGG](https://redirect.github.com/SSDWGG)! - feat(er): support optional ER attribute types with a `?` suffix - [#​7772](https://redirect.github.com/mermaid-js/mermaid/pull/7772) [`37f2e36`](https://redirect.github.com/mermaid-js/mermaid/commit/37f2e36fa017698b66093ac5518396523a7a3241) Thanks [@​devareddy05](https://redirect.github.com/devareddy05)! - feat(gantt): support multiple `excludes` / `includes` lines so long exclusion lists can be split into commented groups ([#​6270](https://redirect.github.com/mermaid-js/mermaid/issues/6270)) - [#​7708](https://redirect.github.com/mermaid-js/mermaid/pull/7708) [`4e63e9d`](https://redirect.github.com/mermaid-js/mermaid/commit/4e63e9d338b6476df283afd4a002072945bc4563) Thanks [@​txmxthy](https://redirect.github.com/txmxthy)! - feat(architecture): add `align row|column {ids…}` directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly. - [#​7760](https://redirect.github.com/mermaid-js/mermaid/pull/7760) [`05223be`](https://redirect.github.com/mermaid-js/mermaid/commit/05223bee47a424be3ba7805e753b96861d342765) Thanks [@​ngdaniels](https://redirect.github.com/ngdaniels)! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice - [#​7251](https://redirect.github.com/mermaid-js/mermaid/pull/7251) [`216e4e9`](https://redirect.github.com/mermaid-js/mermaid/commit/216e4e9a61afceae885b00854f79e17373ccad31) Thanks [@​ydah](https://redirect.github.com/ydah)! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta). - [#​7774](https://redirect.github.com/mermaid-js/mermaid/pull/7774) [`e5c75e6`](https://redirect.github.com/mermaid-js/mermaid/commit/e5c75e6b797f84f8f652d8771eb1ce6161dd8f89) Thanks [@​ngdaniels](https://redirect.github.com/ngdaniels)! - feat(xychart): enable rotate label on X-axis - [#​7791](https://redirect.github.com/mermaid-js/mermaid/pull/7791) [`974fa7b`](https://redirect.github.com/mermaid-js/mermaid/commit/974fa7b7e791b442ad5f7862f1cbecd53d982485) Thanks [@​knsv-bot](https://redirect.github.com/knsv-bot)! - feat(swimlane): add swimlane as a standalone diagram type with a dedicated layered orthogonal layout algorithm ##### Patch Changes - [#​7744](https://redirect.github.com/mermaid-js/mermaid/pull/7744) [`633c261`](https://redirect.github.com/mermaid-js/mermaid/commit/633c261dadbaa20ee0cf9a0299e2269abe4ca573) Thanks [@​ashishjain0512](https://redirect.github.com/ashishjain0512)! - fix(architecture): add `architecture.seed` config option to make architecture diagrams render deterministically. Resolves [#​7729](https://redirect.github.com/mermaid-js/mermaid/issues/7729). - [#​7732](https://redirect.github.com/mermaid-js/mermaid/pull/7732) [`c8ba156`](https://redirect.github.com/mermaid-js/mermaid/commit/c8ba156f551e94dd9a5c30b4971fe83ef3538634) Thanks [@​rkdfx](https://redirect.github.com/rkdfx)! - fix: tolerate leading horizontal whitespace before YAML frontmatter delimiters. Closes [#​7613](https://redirect.github.com/mermaid-js/mermaid/issues/7613) - [#​7314](https://redirect.github.com/mermaid-js/mermaid/pull/7314) [`4e4e6c4`](https://redirect.github.com/mermaid-js/mermaid/commit/4e4e6c4a108d834dd0f643b08deb89159e0eca94) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix(flowchart): Prevent crash when flowchart node shape is undefined - [#​7762](https://redirect.github.com/mermaid-js/mermaid/pull/7762) [`cfd2391`](https://redirect.github.com/mermaid-js/mermaid/commit/cfd23916f3c6b3ceafc4c0cfaf4078f6442bbc4f) Thanks [@​Dharya-dev](https://redirect.github.com/Dharya-dev)! - fix(class): support styling and callbacks for generic classes - [#​7284](https://redirect.github.com/mermaid-js/mermaid/pull/7284) [`c1f116d`](https://redirect.github.com/mermaid-js/mermaid/commit/c1f116d36646786326c596a5f25e519bdaac7748) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix(gantt): Render gantt vertical markers without affecting row layout or chart height - [#​7786](https://redirect.github.com/mermaid-js/mermaid/pull/7786) [`72fbab1`](https://redirect.github.com/mermaid-js/mermaid/commit/72fbab1a4d6efbfa219b13c1639dabcadc754ad8) Thanks [@​knsv-bot](https://redirect.github.com/knsv-bot)! - fix(er): allow special characters (e.g. dots) in ER diagram attribute names and types by escaping them with backticks - [#​7672](https://redirect.github.com/mermaid-js/mermaid/pull/7672) [`4887e97`](https://redirect.github.com/mermaid-js/mermaid/commit/4887e9721c33b5d771306a4e7ab768d78908a157) Thanks [@​sjackson0109](https://redirect.github.com/sjackson0109)! - fix(flowchart): respect per-subgraph direction keyword in Dagre layout. Fixes [#​4648](https://redirect.github.com/mermaid-js/mermaid/issues/4648) - [#​7734](https://redirect.github.com/mermaid-js/mermaid/pull/7734) [`a4c1e50`](https://redirect.github.com/mermaid-js/mermaid/commit/a4c1e507a347256f1f3a42be3feb5b6ddc7257f2) Thanks [@​OfirHaf](https://redirect.github.com/OfirHaf)! - fix(block): read block padding and sanitize config dynamically instead of at module load time - [#​7674](https://redirect.github.com/mermaid-js/mermaid/pull/7674) [`cc75089`](https://redirect.github.com/mermaid-js/mermaid/commit/cc750896b21a2715256ac0de486bafe0351c40c4) Thanks [@​cyphercodes](https://redirect.github.com/cyphercodes)! - fix(block): respect current DOMPurify config when sanitizing labels - [#​7711](https://redirect.github.com/mermaid-js/mermaid/pull/7711) [`be2e282`](https://redirect.github.com/mermaid-js/mermaid/commit/be2e28201445505ec68b1ebf6e3e6813fb6a6898) Thanks [@​Jinacker](https://redirect.github.com/Jinacker)! - fix(flowchart): render flowchart and state self-loop edges as a single SVG path. - [#​7781](https://redirect.github.com/mermaid-js/mermaid/pull/7781) [`d945968`](https://redirect.github.com/mermaid-js/mermaid/commit/d945968c13b154dcf2c89ad1e6ed5104458d32fe) Thanks [@​Dharya-dev](https://redirect.github.com/Dharya-dev)! - fix(radar): align axis labels based on angular position to prevent clipping - [#​7661](https://redirect.github.com/mermaid-js/mermaid/pull/7661) [`2f5e9e8`](https://redirect.github.com/mermaid-js/mermaid/commit/2f5e9e8c9aabb74e61e43428e91217e9585c8d05) Thanks [@​nabila401](https://redirect.github.com/nabila401)! - fix(venn): fix 3-circle venn diagram union rendering - [#​7780](https://redirect.github.com/mermaid-js/mermaid/pull/7780) [`8dcdce4`](https://redirect.github.com/mermaid-js/mermaid/commit/8dcdce40ee091aafd546aa842aca8b4da1e49c1b) Thanks [@​Dharya-dev](https://redirect.github.com/Dharya-dev)! - fix(xychart): truncate plot data to match x-axis category count - [#​7235](https://redirect.github.com/mermaid-js/mermaid/pull/7235) [`1bbc189`](https://redirect.github.com/mermaid-js/mermaid/commit/1bbc189b69be4c50a08ba74501567123769f30bb) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix: Support consecutive LaTeX in node text - [#​7247](https://redirect.github.com/mermaid-js/mermaid/pull/7247) [`365c1b1`](https://redirect.github.com/mermaid-js/mermaid/commit/365c1b1062dd6b5b7c59682f7df6b5c9ed40cd16) Thanks [@​darshanr0107](https://redirect.github.com/darshanr0107)! - fix(treeView): Ensure treemap labels render correctly in large nested diagrams - [#​7754](https://redirect.github.com/mermaid-js/mermaid/pull/7754) [`06a32b7`](https://redirect.github.com/mermaid-js/mermaid/commit/06a32b74fbe574ba36fb77ffd9743a8b884b2f55) Thanks [@​palgunatm66](https://redirect.github.com/palgunatm66)! - fix(sequence): sequenceDiagram rect backgrounds using theme-aware fallback colors - [#​7693](https://redirect.github.com/mermaid-js/mermaid/pull/7693) [`afaf306`](https://redirect.github.com/mermaid-js/mermaid/commit/afaf3062381d115d66744413151b642f124dd9ba) Thanks [@​dull-bird](https://redirect.github.com/dull-bird)! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Fixes [#​7120](https://redirect.github.com/mermaid-js/mermaid/issues/7120). - [#​7751](https://redirect.github.com/mermaid-js/mermaid/pull/7751) [`79e97cd`](https://redirect.github.com/mermaid-js/mermaid/commit/79e97cd7b9cb8f2d9bf6ba6d04de5cdeb4223d1b) Thanks [@​puneetdixit200](https://redirect.github.com/puneetdixit200)! - fix(state): render state diagram click tooltips with mermaidTooltip - [#​7570](https://redirect.github.com/mermaid-js/mermaid/pull/7570) [`c2305df`](https://redirect.github.com/mermaid-js/mermaid/commit/c2305df424963c0263d1c75804248db2969ee17e) Thanks [@​PinguinsRule](https://redirect.github.com/PinguinsRule)! - fix(state): Fix invalid syntax between state and '{' - [#​7758](https://redirect.github.com/mermaid-js/mermaid/pull/7758) [`a4a250b`](https://redirect.github.com/mermaid-js/mermaid/commit/a4a250b96321e0648eecfbadbfb17b1537dff691) Thanks [@​mk24x7](https://redirect.github.com/mk24x7)! - fix(venn): render labeled higher-arity unions when the underlying pairwise unions are not declared. Resolves [#​7656](https://redirect.github.com/mermaid-js/mermaid/issues/7656). - Updated dependencies \[[`ea1c48f`](https://redirect.github.com/mermaid-js/mermaid/commit/ea1c48f53fce5d025388d386c90da8743ee25b13), [`b4d0442`](https://redirect.github.com/mermaid-js/mermaid/commit/b4d0442dd1628acb3f71681519e7f47fc8bacf55), [`4e63e9d`](https://redirect.github.com/mermaid-js/mermaid/commit/4e63e9d338b6476df283afd4a002072945bc4563), [`216e4e9`](https://redirect.github.com/mermaid-js/mermaid/commit/216e4e9a61afceae885b00854f79e17373ccad31)]: - [@​mermaid-js/parser](https://redirect.github.com/mermaid-js/parser)@​1.2.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/toeverything/AFFiNE). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6ImNhbmFyeSIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
AFFiNE.Pro
Write, Draw and Plan All at Once
A privacy-focused, local-first, open-source, and ready-to-use alternative for Notion & Miro.
One hyper-fused platform for wildly creative minds.
Docs, canvas and tables are hyper-merged with AFFiNE - just like the word affine (əˈfʌɪn | a-fine).
Getting started & staying tuned with us.
Star us, and you will receive all release notifications from GitHub without any delay!
What is AFFiNE
AFFiNE is an open-source, all-in-one workspace and an operating system for all the building blocks that assemble your knowledge base and much more -- wiki, knowledge management, presentation and digital assets. It's a better alternative to Notion and Miro.
Features
A true canvas for blocks in any form. Docs and whiteboard are now fully merged.
- Many editor apps claim to be a canvas for productivity, but AFFiNE is one of the very few which allows you to put any building block on an edgeless canvas -- rich text, sticky notes, any embedded web pages, multi-view databases, linked pages, shapes and even slides. We have it all.
Multimodal AI partner ready to kick in any work
- Write up professional work report? Turn an outline into expressive and presentable slides? Summary an article into a well-structured mindmap? Sorting your job plan and backlog for tasks? Or... draw and code prototype apps and web pages directly all with one prompt? With you, AFFiNE AI pushes your creativity to the edge of your imagination, just like Canvas AI to generate mind map for brainstorming.
Local-first & Real-time collaborative
- We love the idea of local-first that you always own your data on your disk, in spite of the cloud. Furthermore, AFFiNE supports real-time sync and collaborations on web and cross-platform clients.
Self-host & Shape your own AFFiNE
- You have the freedom to manage, self-host, fork and build your own AFFiNE. Plugin community and third-party blocks are coming soon. More tractions on Blocksuite. Check there to learn how to self-host AFFiNE.
Acknowledgement
“We shape our tools and thereafter our tools shape us”. A lot of pioneers have inspired us along the way, e.g.:
- Quip & Notion with their great concept of “everything is a block”
- Trello with their Kanban
- Airtable & Miro with their no-code programmable datasheets
- Miro & Whimiscal with their edgeless visual whiteboard
- Remote & Capacities with their object-based tag system
There is a large overlap of their atomic “building blocks” between these apps. They are not open source, nor do they have a plugin system like Vscode for contributors to customize. We want to have something that contains all the features we love and also goes one step even further.
Thanks for checking us out, we appreciate your interest and sincerely hope that AFFiNE resonates with you! 🎵 Checking https://affine.pro/ for more details ions.
Contributing
| Bug Reports | Feature Requests | Questions/Discussions | AFFiNE Community |
|---|---|---|---|
| Create a bug report | Submit a feature request | Check GitHub Discussion | Visit the AFFiNE's Discord |
| Something isn't working as expected | An idea for a new feature, or improvements | Discuss and ask questions | A place to ask, learn and engage with others |
Calling all developers, testers, tech writers and more! Contributions of all types are more than welcome, you can read more in docs/types-of-contributions.md. If you are interested in contributing code, read our docs/CONTRIBUTING.md and feel free to check out our GitHub issues to get stuck in to show us what you’re made of.
Before you start contributing, please make sure you have read and accepted our Contributor License Agreement. To indicate your agreement, simply edit this file and submit a pull request.
For bug reports, feature requests and other suggestions you can also create a new issue and choose the most appropriate template for your feedback.
For translation and language support you can visit our Discord.
If you have questions, you are welcome to contact us. One of the best places to get more info and learn more is in the Discord where you can engage with other like-minded individuals.
Templates
AFFiNE now provides pre-built templates from our team. Following are the Top 10 most popular templates among AFFiNE users,if you want to contribute, you can contribute your own template so other people can use it too.
- vision board template
- one pager template
- sample lesson plan math template
- grr lesson plan template free
- free editable lesson plan template for pre k
- high note collection planners
- digital planner
- ADHD Planner
- Reading Log
- Cornell Notes Template
Blog
Welcome to the AFFiNE blog section! Here, you’ll find the latest insights, tips, and guides on how to maximize your experience with AFFiNE and AFFiNE AI, the leading Canvas AI tool for flexible note-taking and creative organization.
- vision board template
- ai homework helper
- vision board maker
- itinerary template
- one pager template
- cornell notes template
- swot chart template
- apps like luna task
- note taking ai from rough notes to mind map
- canvas ai
- one pager
- SOP Template
- Chore Chart
Ecosystem
| Name | ||
|---|---|---|
| @affine/component | AFFiNE Component Resources |  |
| @toeverything/theme | AFFiNE theme |  |
Upstreams
We would also like to give thanks to open-source projects that make AFFiNE possible:
-
Blocksuite - 💠 BlockSuite is the open-source collaborative editor project behind AFFiNE.
-
y-octo - 🐙 y-octo is a native, high-performance, thread-safe YJS CRDT implementation, serving as the core engine enabling the AFFiNE Client/Server to achieve "local-first" functionality.
-
OctoBase - 🐙 OctoBase is the open-source database behind AFFiNE, local-first, yet collaborative. A light-weight, scalable, data engine written in Rust.
-
yjs - Fundamental support of CRDTs for our implementation on state management and data sync on web.
-
electron - Build cross-platform desktop apps with JavaScript, HTML, and CSS.
-
React - The library for web and native user interfaces.
-
napi-rs - A framework for building compiled Node.js add-ons in Rust via Node-API.
-
Jotai - Primitive and flexible state management for React.
-
async-call-rpc - A lightweight JSON RPC client & server.
-
Vite - Next generation frontend tooling.
-
Other upstream dependencies.
Thanks a lot to the community for providing such powerful and simple libraries, so that we can focus more on the implementation of the product logic, and we hope that in the future our projects will also provide a more easy-to-use knowledge base for everyone.
Contributors
We would like to express our gratitude to all the individuals who have already contributed to AFFiNE! If you have any AFFiNE-related project, documentation, tool or template, please feel free to contribute it by submitting a pull request to our curated list on GitHub: awesome-affine.
Self-Host
Begin with Docker to deploy your own feature-rich, unrestricted version of AFFiNE. Our team is diligently updating to the latest version. For more information on how to self-host AFFiNE, please refer to our documentation.
Feature Request
For feature requests, please see discussions.
Building
Codespaces
From the GitHub repo main page, click the green "Code" button and select "Create codespace on master". This will open a new Codespace with the (supposedly auto-forked AFFiNE repo cloned, built, and ready to go).
Local
See BUILDING.md for instructions on how to build AFFiNE from source code.
Contributing
We welcome contributions from everyone. See docs/contributing/tutorial.md for details.
License
Editions
-
AFFiNE Community Edition (CE) is the current available version, it's free for self-host under the MIT license.
-
AFFiNE Enterprise Edition (EE) is yet to be published, it will have more advanced features and enterprise-oriented offerings, including but not exclusive to rebranding and SSO, advanced admin and audit, etc., you may refer to https://affine.pro/pricing for more information
See LICENSE for details.