You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Merlay 0.3.2 — Obsidian review compliance and security hardening
Mermaid, your way. A native visual overlay editor for Mermaid diagrams in Obsidian.
Fixes & Compliance
Obsidian Review Compliance:
No Static Style Assignments (obsidianmd/no-static-styles-assignment):
Replaced all static inline style assignments on exported SVG elements with standard SVG presentation attributes (fill, stroke, stroke-width, stroke-dasharray).
Added .merlay-color-probe utility class to styles.css to read computed theme variables without inline style mutations.
Used dynamic variable bindings for root SVG dimensions and export background colors.
Safe SVG Parsing (@microsoft/sdl/no-inner-html):
Removed unsafe div.innerHTML fallback in parseSvgString(), relying entirely on standard DOMParser with image/svg+xml and text/html.
Removed exportDiagram.ts from compliance allowlist; zero innerHTML exceptions remain in the codebase.
Eliminated undescribed eslint-disable directive comments; refactored showNotice() to resolve runtime Obsidian module safely across headless and plugin environments.
Static Compliance Test Suite:
Upgraded tests/obsidianCompliance.test.ts to statically test for forbidden static style assignments, undescribed directive comments, and unverified innerHTML usage on every build.
Install
BRAT (beta): add https://github.com/dev-hashemi/merlay in BRAT → Add Beta plugin.
Manual: download main.js, manifest.json, styles.css below into .obsidian/plugins/merlay/, then enable Merlay under Settings → Community plugins.
Requires Obsidian 1.4.0 or newer. Desktop and mobile supported.
Notes
Flowchart and state diagrams are fully visual; other diagram types open view-only with selection.
reacted with thumbs up emoji reacted with thumbs down emoji reacted with laugh emoji reacted with hooray emoji reacted with confused emoji reacted with heart emoji reacted with rocket emoji reacted with eyes emoji
Uh oh!
There was an error while loading. Please reload this page.
Merlay 0.3.2 — Obsidian review compliance and security hardening
Fixes & Compliance
obsidianmd/no-static-styles-assignment):fill,stroke,stroke-width,stroke-dasharray)..merlay-color-probeutility class tostyles.cssto read computed theme variables without inline style mutations.@microsoft/sdl/no-inner-html):div.innerHTMLfallback inparseSvgString(), relying entirely on standardDOMParserwithimage/svg+xmlandtext/html.exportDiagram.tsfrom compliance allowlist; zeroinnerHTMLexceptions remain in the codebase.eslint-comments/require-description):eslint-disabledirective comments; refactoredshowNotice()to resolve runtime Obsidian module safely across headless and plugin environments.tests/obsidianCompliance.test.tsto statically test for forbidden static style assignments, undescribed directive comments, and unverifiedinnerHTMLusage on every build.Install
BRAT (beta): add
https://github.com/dev-hashemi/merlayin BRAT → Add Beta plugin.Manual: download
main.js,manifest.json,styles.cssbelow into.obsidian/plugins/merlay/, then enable Merlay under Settings → Community plugins.Requires Obsidian
1.4.0or newer. Desktop and mobile supported.Notes
mermaidblock that reproduces the problem.Full Changelog: 0.3.1...0.3.2
This discussion was created from the release Merlay 0.3.2.
All reactions