chore(deps): bump mermaid to 11.16.1

[elkaix]

Related Issue

No issue. The problem is described below.

Problem

Dependabot reports nine open alerts against main. Five of them are mermaid@11.16.0, a direct dependency of the documentation site:

Severity	Advisory
Medium	Configuration APIs allow prototype pollution
Medium	Architecture diagrams are vulnerable to prototype pollution
Medium	CSS injection applying to sibling elements of the diagram
Medium	Radar diagrams are vulnerable to denial of service
Low	XY charts are vulnerable to an infinite loop denial of service

All five are fixed in 11.16.1, which the declared ^11.16.0 range already permits — only the lockfile held the old version.

What changed

• mermaid moves to 11.16.1 in docs/package.json and the lockfile.
• The pnpmDeps hash in flake.nix is refreshed, because any lockfile change invalidates it.

The remaining four alerts are out of scope and cannot be fixed here. They are vite@5.4.21 (one high, two medium) and its esbuild@0.21.5 dependency, both reached only through vitepress@1.6.4, which is the latest stable release and pins vite: ^5.4.14. The fix exists only in vite@6.4.3 with no 5.x backport, so clearing them needs VitePress 2.0, currently an alpha. Every one of those advisories is a development-server issue, and the vulnerable copy exists only under docs/ — the other five workspaces already pin vite ^6.4.3.

Verification

• nix build .#pythinker-code.pnpmDeps passes with the new hash. The old hash was confirmed stale by forcing a mismatch: a fixed-output derivation is content-addressed, so a local build reuses the cached path and reports success even when the lockfile has moved.
• node scripts/check-nix-workspace.mjs passes.
• pnpm exec vitest run passes: 651 files, 9949 tests.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue, or explained the problem above.
• I have added tests that prove my feature works. — Not applicable; this is a dependency bump with no behaviour change.
• Ran gen-changesets skill, or this PR needs no changeset. — No changeset: the bump touches only the documentation site's dependencies and does not enter the CLI bundle.
• Ran gen-docs skill, or this PR needs no doc update.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 24 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 9bb6de7f-6344-4809-885f-1d5314eb956b

📥 Commits

Reviewing files that changed from the base of the PR and between 6801443 and e527115.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/pnpm-lock.yaml

📒 Files selected for processing (2)

• docs/package.json
• flake.nix

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@pythoughts/pythinker-code@e527115

npx https://pkg.pr.new/@pythoughts/pythinker-code@e527115

commit: e527115