Skip to content

fix(deps): update dependency mermaid to v10.9.3 [security] - autoclosed#1776

Closed
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-mermaid-vulnerability
Closed

fix(deps): update dependency mermaid to v10.9.3 [security] - autoclosed#1776
renovate[bot] wants to merge 1 commit intomasterfrom
renovate/npm-mermaid-vulnerability

Conversation

@renovate
Copy link
Copy Markdown
Contributor

@renovate renovate bot commented Apr 5, 2026 •
edited
Loading

This PR contains the following updates:

Package Change Age Confidence
mermaid 10.5.0 → 10.9.3 age confidence

GitHub Vulnerability Alerts

GHSA-m4gq-x24j-jpmf

The following bundled files within the Mermaid NPM package contain a bundled version of DOMPurify that is vulnerable to GHSA-mmhx-hmjr-r674, potentially resulting in an XSS attack.

This affects the built:

  • dist/mermaid.min.js
  • dist/mermaid.js
  • dist/mermaid.esm.mjs
  • dist/mermaid.esm.min.mjs

This will also affect users that use the above files via a CDN link, e.g. https://cdn.jsdelivr.net/npm/mermaid@10.9.2/dist/mermaid.min.js

Users that use the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or the dist/mermaid.core.mjs file, do not use this bundled version of DOMPurify, and can easily update using their package manager with something like npm audit fix.

Patches

  • develop branch: 6c785c93166c151d27d328ddf68a13d9d65adc00
  • backport to v10: 92a07ffe40aab2769dd1c3431b4eb5beac282b34

Release Notes

mermaid-js/mermaid (mermaid)

v10.9.3

Compare Source

Updates the bundled version of dependencies in the following files:

  • dist/mermaid.min.js
  • dist/mermaid.js
  • dist/mermaid.esm.mjs
  • dist/mermaid.esm.min.mjs

If you are not using these files (e.g. you are using the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or you are using dist/mermaid.core.mjs), this release is identical to v10.9.2.

This is to avoid potential security issues in KaTeX and DOMPurify, see:

These dependencies have already been updated in v11.0.0.

Changelog

Chore
  • Updates the bundled version of KaTeX to 0.16.11 (2bedd0e)
  • Updates the bundled version of DOMPurify to 3.1.6 (92a07ff)

Full Changelog: mermaid-js/mermaid@v10.9.2...v10.9.3

v10.9.2

Compare Source

This release back-ports #​5914 to the v10 release line to fix #​5904 (an incompatibility between mermaid and DOMPurify v3.1.7)

Patch Changes

Full Changelog: mermaid-js/mermaid@v10.9.1...v10.9.2

v10.9.1

Compare Source

What's Changed

BugFixes

  • Cleaning of labels in Block diagram by @​knsv

Docs

New Contributors

Full Changelog: mermaid-js/mermaid@v10.9.0...v10.9.1

v10.9.0

Compare Source

Release Notes

We now have Katex support!

image
Demo

🚀 Features

🧰 Maintenance

📚 Documentation

🎉 Thanks to all contributors helping with this release! 🎉

v10.8.0

Compare Source

v10.8.0

Features

image

Documentation

Bug fixes

Chores

New Contributors

Full Changelog: mermaid-js/mermaid@v10.7.0...v10.8.0

v10.7.0

Compare Source

Release Notes

🚀 Features

🐛 Bug Fixes

🧰 Maintenance

📚 Documentation

🎉 Thanks to all contributors helping with this release! 🎉

v10.6.1: 10.6.1

Compare Source

What's Changed

Bugfixes

  • fix(flow): fix invalid ellipseText regex (#​5016) @​aloisklink
    • This was causing freezes in flowcharts that had a ( char in ellipse nodes

Documentation

Chores

🎉 Thanks to all contributors helping with this release! 🎉

v10.6.0: 10.6.0

Compare Source

What's Changed

Fix

Docs

Chores

New Contributors

Full Changelog: mermaid-js/mermaid@v10.5.1...v10.6.0

v10.5.1

Compare Source

What's Changed

Full Changelog: mermaid-js/mermaid@v10.5.0...v10.5.1

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot added the dependencies Pull requests that update a dependency file label Apr 5, 2026
@safedep
Copy link
Copy Markdown

safedep bot commented Apr 5, 2026 •
edited
Loading

SafeDep Report Summary

Green Malicious Packages Badge Green Vulnerable Packages Badge Green Risky License Badge

Package Details
Package Malware Vulnerability Risky License Report
icon call-bind @ 1.0.8
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon commander @ 8.3.0
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon cytoscape @ 3.33.2
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon debug @ 4.4.3
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon elkjs @ 0.9.3
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon is-string @ 1.1.1
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon katex @ 0.16.45
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗
icon mermaid @ 10.9.3
pnpm-lock.yaml		 ok icon
 ok icon
 ok icon
 🔗

View complete scan results →

This report is generated by SafeDep Github App

@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 77512e1 to 2ee03ef Compare April 5, 2026 13:35
@github-actions
Copy link
Copy Markdown

github-actions bot commented Apr 5, 2026 •
edited
Loading

📦 Next.js Bundle Analysis for mx-kami

This analysis was generated by the Next.js Bundle Analysis action. 🤖

⚠️ Global Bundle Size Increased

Page Size (compressed)
global 220.43 KB (🟡 +73 B)
Details

The global bundle is the javascript bundle that loads alongside every page. It is in its own category because its impact is much higher - an increase to its size means that every page on your website loads slower, and a decrease means every page loads faster.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

If you want further insight into what is behind the changes, give @next/bundle-analyzer a try!

Seven Pages Changed Size

The following pages changed size from the code in this PR compared to its base branch:

Page Size (compressed) First Load % of Budget (350 KB)
/[locale]/[page] 51.03 KB 271.46 KB 77.56% (+/- <0.01%)
/[locale]/friends 55.81 KB 276.25 KB 78.93% (+/- <0.01%)
/[locale]/notes/[id] 74.03 KB 294.46 KB 84.13% (+/- <0.01%)
/[locale]/posts/[category]/[slug] 78.46 KB 298.9 KB 85.40% (+/- <0.01%)
/[locale]/preview 54.91 KB 275.34 KB 78.67% (+/- <0.01%)
/[locale]/projects/[id] 50.17 KB 270.6 KB 77.32% (+/- <0.01%)
/[locale]/recently 95.53 KB 315.97 KB 90.28% (+/- <0.01%)
Details

Only the gzipped size is provided here based on an expert tip.

First Load is the size of the global bundle plus the bundle for the individual page. If a user were to show up to your website and land on a given page, the first load size represents the amount of javascript that user would need to download. If next/link is used, subsequent page loads would only need to download that page's bundle (the number in the "Size" column), since the global bundle has already been downloaded.

Any third party scripts you have added directly to your app using the <script> tag are not accounted for in this analysis

The "Budget %" column shows what percentage of your performance budget the First Load total takes up. For example, if your budget was 100kb, and a given page's first load size was 10kb, it would be 10% of your budget. You can also see how much this has increased or decreased compared to the base branch of your PR. If this percentage has increased by 20% or more, there will be a red status indicator applied, indicating that special attention should be given to this. If you see "+/- <0.01%" it means that there was a change in bundle size, but it is a trivial enough amount that it can be ignored.

@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 2ee03ef to 173bffa Compare April 5, 2026 13:41
@renovate renovate bot force-pushed the renovate/npm-mermaid-vulnerability branch from 173bffa to f8b2059 Compare April 8, 2026 16:58
@renovate renovate bot changed the title fix(deps): update dependency mermaid to v10.9.3 [security] fix(deps): update dependency mermaid to v10.9.3 [security] - autoclosed Apr 12, 2026
@renovate renovate bot closed this Apr 12, 2026
@renovate renovate bot deleted the renovate/npm-mermaid-vulnerability branch April 12, 2026 12:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants