Skip to content

2026.8.10-canary.931

Pre-release
Pre-release

Choose a tag to compare

View all tags
@github-actions github-actions released this 10 Aug 10:03
· 2 commits to canary since this release
v2026.8.10-canary.931
7bc349c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode. 
chore: bump up mermaid version to v11.16.1 [SECURITY] (#15443)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [mermaid](https://redirect.github.com/mermaid-js/mermaid) | [`11.15.0`
→ `11.16.1`](https://renovatebot.com/diffs/npm/mermaid/11.15.0/11.16.1)
|
![age](https://developer.mend.io/api/mc/badges/age/npm/mermaid/11.16.1?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mermaid/11.15.0/11.16.1?slim=true)
|

---

### Mermaid XY Charts are vulnerable to an infinite loop DoS
[CVE-2026-71436](https://nvd.nist.gov/vuln/detail/CVE-2026-71436) /
[GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the
`setXAxisRangeData()`, when configuring an X-Axis with invalid
parameters.

As each loop appends an element to an array, this would generally only
cause an `RangeError: Invalid array length` to appear after a few
seconds, but may cause the page/JavaScript process to crash due to
memory exhaustion, depending on the environment.

##### Proof-of-concept

```txt
xychart
  x-axis 1 --> 1
  line [1, 2]
```

##### Patches

This has been patched in
https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
and released in [Mermaid
v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).

A backport has been made for the v10 branch in
ef60adc837d9d5107af21285f01e83dea309bd0a and was released in [Mermaid
v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8)

##### Workarounds

There are no known workarounds. Please update to the latest version or
apply the patch.

##### References

-
https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
-
https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7)
-
[https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
-
[https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289](https://redirect.github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289)
-
[https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a](https://redirect.github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8)
-
[https://github.com/advisories/GHSA-2v8p-3f2j-5mp7](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-2v8p-3f2j-5mp7)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid Architecture diagrams are vulnerable to prototype pollution
[CVE-2026-71437](https://nvd.nist.gov/vuln/detail/CVE-2026-71437) /
[GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3)

<details>
<summary>More information</summary>

#### Details
Rendering an untrusted `architecture-beta` diagram lets the diagram
author write an arbitrary property with the value `horizontal` or
`vertical` onto `Object.prototype`. A group id of `__proto__` is
accepted as a valid parent.

##### Impact

Any code in the same realm that reads a property of that name from an
arbitrary object, or enumerates an object with bare `for...in`, observes
the injected value (which can only be the string `horizontal` or
`vertical`.

This may mean corrupted option/config defaults, bypassed truthiness
checks, causing denial of service or logic corruption in the embedding
application.

Because the injected value cannot be an object or function, this is not
directly exploitable for remote code execution.

##### PoC

```
architecture-beta
      group mermaidPrototypePollutionMarker(cloud)[Marker]
      service a(server)[A] in __proto__
      service b(server)[B] in mermaidPrototypePollutionMarker
      a:R -- L:b
```

The vulnerable write was introduced in commit
[cb0a4703bdf01d47508bde1c08aa9a980d70bc20](https://redirect.github.com/mermaid-js/mermaid/commit/cb0a4703bdf01d47508bde1c08aa9a980d70bc20)
and first shipped in `mermaid@11.5.0`. The lines are unchanged in every
release since.

##### Patches

This has been patched by
https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf,
released in [Mermaid
v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1)

##### Workarounds

There are no known workarounds. Please update to a patched version.

##### References

_Are there any links users can visit to find out more?_

-
https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

#### Severity
- CVSS Score: 6.5 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-3rrr-jr9j-h3q3)
-
[https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
-
[https://github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf](https://redirect.github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1)
-
[https://github.com/advisories/GHSA-3rrr-jr9j-h3q3](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-3rrr-jr9j-h3q3)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid allows CSS injection applying to sibling elements of the
diagram
[CVE-2026-50159](https://nvd.nist.gov/vuln/detail/CVE-2026-50159) /
[GHSA-6x64-9x62-f2gx](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx)

<details>
<summary>More information</summary>

#### Details
##### Summary

Mermaid does not fully restrict CSS to the rendered SVG subtree.
Although selectors are prefixed with `#mermaid-X`, sibling (`~` and `+`)
combinators can still escape the Mermaid container and inject styles to
DOM elements adjacent to the diagram `<svg>`.

**Most users of mermaid would not be affected by this**, as mermaid adds
its `<svg>` as an only child of it's parent element. However, you may be
affected if you manually insert the `<svg>` (or other elements) into the
DOM yourself.

##### Details

Mermaid namespaces CSS through with a middleware intended to scope all
rules to the diagram's SVG element. CSS nesting expands `& ~ * { ... }`
to `#svgId ~ *`, which selects all sibling elements following the SVG in
the DOM, outside the diagram boundary.

##### Impact

An attacker able to supply diagram source to a page (e.g.,
user-generated content rendered by Mermaid) could inject CSS rules
affecting sibling elements to the diagram `<svg>` on the host page. This
can be used for UI redressing, hiding content, conditional CSS-based
probing, or phishing-style visual manipulation.

JavaScript execution is not possible via this vector.

##### Patches

This has been patched in
https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
and released in [Mermaid
v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).

A backport has been made for the v10 branch in
7e83f1533318b307764d961906a73377266f4c5e and was released in [Mermaid
v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8)

##### Workarounds

If you are inserting the `<svg>` into the DOM yourself, you can wrap it
in an element with no other children, e.g. `<div><svg>...</svg></div>`
or `element.innerHTML = svg`. Alternatively, you can use `mermaid.run()`
or `mermaid.initialize()` which will do this for you.

Setting ["securityLevel":
"sandbox"](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)
will also prevent this, or setting the
[`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure)
config value in the mermaid config to avoid allowing diagrams to modify
`fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`.

To test, you can try using a `themeCSS` with `& + * { /* my CSS here
*/}` and see if it's applied outside of your mermaid `<svg>`.

```mermaid-example
---
config:
  themeCSS: |-
    & + * { background:red !important; width:100vw !important; height:100vh !important; position:fixed !important; inset:0 !important; }
---
info
```

##### References

- GHSA-87f9-hvmw-gh4p/CVE-2026-41159 (related vulnerability)
-
https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
-
https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
- https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx)
-
[https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
-
[https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed](https://redirect.github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed)
-
[https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e](https://redirect.github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8)
-
[https://github.com/advisories/GHSA-6x64-9x62-f2gx](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-6x64-9x62-f2gx)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid configuration APIs allow prototype pollution
[CVE-2026-71438](https://nvd.nist.gov/vuln/detail/CVE-2026-71438) /
[GHSA-c4c3-pg64-4m4v](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v)

<details>
<summary>More information</summary>

#### Details
##### Summary

Mermaid's configuration setters (`mermaid.initialize`,
`mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig`) merge the
caller-supplied configuration object into Mermaid's internal config
using the `assignWithDepth` deep-merge helper that is vulnerable to
prototype pollution.

Because these APIs are intended to receive **trusted** configuration
supplied by the application integrating Mermaid, Mermaid assesses the
practical risk as **low**. The vulnerability is only reachable if an
application forwards attacker-controlled data directly into one of these
configuration entry points, which is outside their documented usage.

User-controlled configuration (e.g. configuration in diagram code using
`%%{init: {}}%%` or YAML frontmatter) are already protected from
prototype pollution.

##### Patches

This has been patched in
https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
and released in [Mermaid
v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1).

A backport has been made for the v10 branch in
c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in [Mermaid
v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8)

##### Impact

Mermaid believes it's unlikely that anybody is impacted, as these
functions are configuration entry points expected to receive trusted,
developer-controlled values as they can modify other security-relevant
configuration.

##### Workarounds

Don't pass user-controlled data to the `mermaid.initialize`,
`mermaidAPI.setConfig`, and `mermaidAPI.updateSiteConfig` functions.
Instead, users can use `%%{init: {}}%%` or YAML frontmatter in diagrams.

##### Reporters

- liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/
- ziyue0530@&#8203;gmail.com (Ziyue), https://zyy0530.github.io/
- cshe0476@&#8203;uni.sydney.edu.au (Strick),
https://str1ckl4nd.github.io/
- chng0012@&#8203;uni.sydney.edu.au (Maurice),
http://maurice.busystar.org/
- cyu210608@&#8203;gmail.com (Chenchen), https://7thparkk.github.io/

#### Severity
- CVSS Score: 2.4 / 10 (Low)
- Vector String:
`CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v)
-
[https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
-
[https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43)
-
[https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956](https://redirect.github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1)
-
[https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.8)
-
[https://github.com/advisories/GHSA-c4c3-pg64-4m4v](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-c4c3-pg64-4m4v)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid radar diagrams are vulnerable to DoS
[CVE-2026-71439](https://nvd.nist.gov/vuln/detail/CVE-2026-71439) /
[GHSA-rhh3-jpg6-66xh](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid radar diagrams allow arbitrary large values for `ticks`, which
can cause high CPU usage, freezing the webpage/JavaScript process for
long periods of time, until the process is eventually killed due to
OOM/running out of memory.

##### Proof-of-concept

```txt
radar-beta
  axis a, b
  curve c {1, 1}
  ticks 1000000000
```

##### Patches

_Has the problem been patched? What versions should users upgrade to?_

This problem has been patched by
https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e,
which was released in [Mermaid
v11.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1)

##### Workarounds

_Is there a way for users to fix or remediate the vulnerability without
upgrading?_

There are no known workarounds without updating to a patched version of
mermaid.

##### References

_Are there any links users can visit to find out more?_

-
https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e
- https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String:
`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L`

#### References
-
[https://github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-rhh3-jpg6-66xh)
-
[https://github.com/mermaid-js/mermaid/pull/8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
-
[https://github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e](https://redirect.github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e)
-
[https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1)
-
[https://github.com/advisories/GHSA-rhh3-jpg6-66xh](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh)

This data is provided by the [GitHub Advisory
Database](https://redirect.github.com/advisories/GHSA-rhh3-jpg6-66xh)
([CC-BY
4.0](https://redirect.github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>mermaid-js/mermaid (mermaid)</summary>

###
[`v11.16.1`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1)

[Compare
Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.16.0...mermaid@11.16.1)

##### Patch Changes

-
[#&#8203;8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
[`12d472c`](https://redirect.github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
fix: handle CSS sibling combinators in compileCSS

-
[#&#8203;8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
[`2cd6dcf`](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
fix: increase protections against prototype pollution

User-controlled input already has protections against prototype
pollution.

  Fixes: GHSA-c4c3-pg64-4m4v

-
[#&#8203;8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
[`99af3fc`](https://redirect.github.com/mermaid-js/mermaid/commit/99af3fc35ef0a9a9c8c6314521344d67523ddccf)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
fix(architecture): use `Map`s and `Set`s to store groups/services

Services are now rendered in the order they are defined and more service
IDs
  are now supported.

-
[#&#8203;8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
[`2cd6dcf`](https://redirect.github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
deprecate: Deprecate the `mermaidAPI.setConfig()` function

  Calling this function has no observable effect, as the next time a
  `render()` or `parse()` is called, the `currentConfig` is cleared.

-
[#&#8203;8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
[`630aa7e`](https://redirect.github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
fix(xychart): support zero-width x-axis ranges

-
[#&#8203;8022](https://redirect.github.com/mermaid-js/mermaid/pull/8022)
[`59b22fa`](https://redirect.github.com/mermaid-js/mermaid/commit/59b22fad2b3bb04f87a476c84a8a2b24679e607e)
Thanks [@&#8203;aloisklink](https://redirect.github.com/aloisklink)! -
fix(radar): limit number of ticks to 32

  Setting a ticks value higher than this would only show 32 ticks.

###
[`v11.16.0`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.0)

[Compare
Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.16.0)

##### Minor Changes

-
[#&#8203;7535](https://redirect.github.com/mermaid-js/mermaid/pull/7535)
[`ea1c48f`](https://redirect.github.com/mermaid-js/mermaid/commit/ea1c48f53fce5d025388d386c90da8743ee25b13)
Thanks [@&#8203;ragelink](https://redirect.github.com/ragelink)! -
feat(cynefin): Adds the Cynefin framework as a new diagram type (beta)
to Mermaid (available as `cynefin-beta`). The Cynefin framework, created
by Dave Snowden, is a decision-making framework that categorizes
problems into five complexity domains, widely used in agile, incident
management, strategy, and organizational design.

-
[#&#8203;7721](https://redirect.github.com/mermaid-js/mermaid/pull/7721)
[`f45cc2c`](https://redirect.github.com/mermaid-js/mermaid/commit/f45cc2cc5683b90990e374a463b7bcad0fd68a38)
Thanks
[@&#8203;notionparallax](https://redirect.github.com/notionparallax)! -
feat(treeView): add box-drawing character input support for treeView
diagrams

-
[#&#8203;7550](https://redirect.github.com/mermaid-js/mermaid/pull/7550)
[`f1f4d45`](https://redirect.github.com/mermaid-js/mermaid/commit/f1f4d45ee0513b64a2bd280087d31656f9d2c786)
Thanks
[@&#8203;DominicBurkart](https://redirect.github.com/DominicBurkart)! -
feat(xychart): add per-point text labels for xychart line plots

-
[#&#8203;7527](https://redirect.github.com/mermaid-js/mermaid/pull/7527)
[`b4d0442`](https://redirect.github.com/mermaid-js/mermaid/commit/b4d0442dd1628acb3f71681519e7f47fc8bacf55)
Thanks
[@&#8203;notionparallax](https://redirect.github.com/notionparallax)! -
feat(treeView): Extends the existing treeView-beta diagram with features
useful for representing file/directory structures.

-
[#&#8203;7793](https://redirect.github.com/mermaid-js/mermaid/pull/7793)
[`a6f097d`](https://redirect.github.com/mermaid-js/mermaid/commit/a6f097d580d459dfc3ade3e21030037341f79940)
Thanks [@&#8203;SSDWGG](https://redirect.github.com/SSDWGG)! - feat(er):
support optional ER attribute types with a `?` suffix

-
[#&#8203;7772](https://redirect.github.com/mermaid-js/mermaid/pull/7772)
[`37f2e36`](https://redirect.github.com/mermaid-js/mermaid/commit/37f2e36fa017698b66093ac5518396523a7a3241)
Thanks [@&#8203;devareddy05](https://redirect.github.com/devareddy05)! -
feat(gantt): support multiple `excludes` / `includes` lines so long
exclusion lists can be split into commented groups
([#&#8203;6270](https://redirect.github.com/mermaid-js/mermaid/issues/6270))

-
[#&#8203;7708](https://redirect.github.com/mermaid-js/mermaid/pull/7708)
[`4e63e9d`](https://redirect.github.com/mermaid-js/mermaid/commit/4e63e9d338b6476df283afd4a002072945bc4563)
Thanks [@&#8203;txmxthy](https://redirect.github.com/txmxthy)! -
feat(architecture): add `align row|column {ids…}` directive to
architecture-beta diagrams so authors can declare horizontal or vertical
alignment of services explicitly.

-
[#&#8203;7760](https://redirect.github.com/mermaid-js/mermaid/pull/7760)
[`05223be`](https://redirect.github.com/mermaid-js/mermaid/commit/05223bee47a424be3ba7805e753b96861d342765)
Thanks [@&#8203;ngdaniels](https://redirect.github.com/ngdaniels)! -
feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position,
and highlight slice

-
[#&#8203;7251](https://redirect.github.com/mermaid-js/mermaid/pull/7251)
[`216e4e9`](https://redirect.github.com/mermaid-js/mermaid/commit/216e4e9a61afceae885b00854f79e17373ccad31)
Thanks [@&#8203;ydah](https://redirect.github.com/ydah)! -
feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with
four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF
(railroad-abnf-beta), and PEG (railroad-peg-beta).

-
[#&#8203;7774](https://redirect.github.com/mermaid-js/mermaid/pull/7774)
[`e5c75e6`](https://redirect.github.com/mermaid-js/mermaid/commit/e5c75e6b797f84f8f652d8771eb1ce6161dd8f89)
Thanks [@&#8203;ngdaniels](https://redirect.github.com/ngdaniels)! -
feat(xychart): enable rotate label on X-axis

-
[#&#8203;7791](https://redirect.github.com/mermaid-js/mermaid/pull/7791)
[`974fa7b`](https://redirect.github.com/mermaid-js/mermaid/commit/974fa7b7e791b442ad5f7862f1cbecd53d982485)
Thanks [@&#8203;knsv-bot](https://redirect.github.com/knsv-bot)! -
feat(swimlane): add swimlane as a standalone diagram type with a
dedicated layered orthogonal layout algorithm

##### Patch Changes

-
[#&#8203;7744](https://redirect.github.com/mermaid-js/mermaid/pull/7744)
[`633c261`](https://redirect.github.com/mermaid-js/mermaid/commit/633c261dadbaa20ee0cf9a0299e2269abe4ca573)
Thanks
[@&#8203;ashishjain0512](https://redirect.github.com/ashishjain0512)! -
fix(architecture): add `architecture.seed` config option to make
architecture diagrams render deterministically. Resolves
[#&#8203;7729](https://redirect.github.com/mermaid-js/mermaid/issues/7729).

-
[#&#8203;7732](https://redirect.github.com/mermaid-js/mermaid/pull/7732)
[`c8ba156`](https://redirect.github.com/mermaid-js/mermaid/commit/c8ba156f551e94dd9a5c30b4971fe83ef3538634)
Thanks [@&#8203;rkdfx](https://redirect.github.com/rkdfx)! - fix:
tolerate leading horizontal whitespace before YAML frontmatter
delimiters. Closes
[#&#8203;7613](https://redirect.github.com/mermaid-js/mermaid/issues/7613)

-
[#&#8203;7314](https://redirect.github.com/mermaid-js/mermaid/pull/7314)
[`4e4e6c4`](https://redirect.github.com/mermaid-js/mermaid/commit/4e4e6c4a108d834dd0f643b08deb89159e0eca94)
Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)!
- fix(flowchart): Prevent crash when flowchart node shape is undefined

-
[#&#8203;7762](https://redirect.github.com/mermaid-js/mermaid/pull/7762)
[`cfd2391`](https://redirect.github.com/mermaid-js/mermaid/commit/cfd23916f3c6b3ceafc4c0cfaf4078f6442bbc4f)
Thanks [@&#8203;Dharya-dev](https://redirect.github.com/Dharya-dev)! -
fix(class): support styling and callbacks for generic classes

-
[#&#8203;7284](https://redirect.github.com/mermaid-js/mermaid/pull/7284)
[`c1f116d`](https://redirect.github.com/mermaid-js/mermaid/commit/c1f116d36646786326c596a5f25e519bdaac7748)
Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)!
- fix(gantt): Render gantt vertical markers without affecting row layout
or chart height

-
[#&#8203;7786](https://redirect.github.com/mermaid-js/mermaid/pull/7786)
[`72fbab1`](https://redirect.github.com/mermaid-js/mermaid/commit/72fbab1a4d6efbfa219b13c1639dabcadc754ad8)
Thanks [@&#8203;knsv-bot](https://redirect.github.com/knsv-bot)! -
fix(er): allow special characters (e.g. dots) in ER diagram attribute
names and types by escaping them with backticks

-
[#&#8203;7672](https://redirect.github.com/mermaid-js/mermaid/pull/7672)
[`4887e97`](https://redirect.github.com/mermaid-js/mermaid/commit/4887e9721c33b5d771306a4e7ab768d78908a157)
Thanks [@&#8203;sjackson0109](https://redirect.github.com/sjackson0109)!
- fix(flowchart): respect per-subgraph direction keyword in Dagre
layout. Fixes
[#&#8203;4648](https://redirect.github.com/mermaid-js/mermaid/issues/4648)

-
[#&#8203;7734](https://redirect.github.com/mermaid-js/mermaid/pull/7734)
[`a4c1e50`](https://redirect.github.com/mermaid-js/mermaid/commit/a4c1e507a347256f1f3a42be3feb5b6ddc7257f2)
Thanks [@&#8203;OfirHaf](https://redirect.github.com/OfirHaf)! -
fix(block): read block padding and sanitize config dynamically instead
of at module load time

-
[#&#8203;7674](https://redirect.github.com/mermaid-js/mermaid/pull/7674)
[`cc75089`](https://redirect.github.com/mermaid-js/mermaid/commit/cc750896b21a2715256ac0de486bafe0351c40c4)
Thanks [@&#8203;cyphercodes](https://redirect.github.com/cyphercodes)! -
fix(block): respect current DOMPurify config when sanitizing labels

-
[#&#8203;7711](https://redirect.github.com/mermaid-js/mermaid/pull/7711)
[`be2e282`](https://redirect.github.com/mermaid-js/mermaid/commit/be2e28201445505ec68b1ebf6e3e6813fb6a6898)
Thanks [@&#8203;Jinacker](https://redirect.github.com/Jinacker)! -
fix(flowchart): render flowchart and state self-loop edges as a single
SVG path.

-
[#&#8203;7781](https://redirect.github.com/mermaid-js/mermaid/pull/7781)
[`d945968`](https://redirect.github.com/mermaid-js/mermaid/commit/d945968c13b154dcf2c89ad1e6ed5104458d32fe)
Thanks [@&#8203;Dharya-dev](https://redirect.github.com/Dharya-dev)! -
fix(radar): align axis labels based on angular position to prevent
clipping

-
[#&#8203;7661](https://redirect.github.com/mermaid-js/mermaid/pull/7661)
[`2f5e9e8`](https://redirect.github.com/mermaid-js/mermaid/commit/2f5e9e8c9aabb74e61e43428e91217e9585c8d05)
Thanks [@&#8203;nabila401](https://redirect.github.com/nabila401)! -
fix(venn): fix 3-circle venn diagram union rendering

-
[#&#8203;7780](https://redirect.github.com/mermaid-js/mermaid/pull/7780)
[`8dcdce4`](https://redirect.github.com/mermaid-js/mermaid/commit/8dcdce40ee091aafd546aa842aca8b4da1e49c1b)
Thanks [@&#8203;Dharya-dev](https://redirect.github.com/Dharya-dev)! -
fix(xychart): truncate plot data to match x-axis category count

-
[#&#8203;7235](https://redirect.github.com/mermaid-js/mermaid/pull/7235)
[`1bbc189`](https://redirect.github.com/mermaid-js/mermaid/commit/1bbc189b69be4c50a08ba74501567123769f30bb)
Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)!
- fix: Support consecutive LaTeX in node text

-
[#&#8203;7247](https://redirect.github.com/mermaid-js/mermaid/pull/7247)
[`365c1b1`](https://redirect.github.com/mermaid-js/mermaid/commit/365c1b1062dd6b5b7c59682f7df6b5c9ed40cd16)
Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)!
- fix(treeView): Ensure treemap labels render correctly in large nested
diagrams

-
[#&#8203;7754](https://redirect.github.com/mermaid-js/mermaid/pull/7754)
[`06a32b7`](https://redirect.github.com/mermaid-js/mermaid/commit/06a32b74fbe574ba36fb77ffd9743a8b884b2f55)
Thanks [@&#8203;palgunatm66](https://redirect.github.com/palgunatm66)! -
fix(sequence): sequenceDiagram rect backgrounds using theme-aware
fallback colors

-
[#&#8203;7693](https://redirect.github.com/mermaid-js/mermaid/pull/7693)
[`afaf306`](https://redirect.github.com/mermaid-js/mermaid/commit/afaf3062381d115d66744413151b642f124dd9ba)
Thanks [@&#8203;dull-bird](https://redirect.github.com/dull-bird)! -
fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and
other non-ASCII text in unquoted axis/quadrant/point labels. Fixes
[#&#8203;7120](https://redirect.github.com/mermaid-js/mermaid/issues/7120).

-
[#&#8203;7751](https://redirect.github.com/mermaid-js/mermaid/pull/7751)
[`79e97cd`](https://redirect.github.com/mermaid-js/mermaid/commit/79e97cd7b9cb8f2d9bf6ba6d04de5cdeb4223d1b)
Thanks
[@&#8203;puneetdixit200](https://redirect.github.com/puneetdixit200)! -
fix(state): render state diagram click tooltips with mermaidTooltip

-
[#&#8203;7570](https://redirect.github.com/mermaid-js/mermaid/pull/7570)
[`c2305df`](https://redirect.github.com/mermaid-js/mermaid/commit/c2305df424963c0263d1c75804248db2969ee17e)
Thanks [@&#8203;PinguinsRule](https://redirect.github.com/PinguinsRule)!
- fix(state): Fix invalid syntax between state and '{'

-
[#&#8203;7758](https://redirect.github.com/mermaid-js/mermaid/pull/7758)
[`a4a250b`](https://redirect.github.com/mermaid-js/mermaid/commit/a4a250b96321e0648eecfbadbfb17b1537dff691)
Thanks [@&#8203;mk24x7](https://redirect.github.com/mk24x7)! -
fix(venn): render labeled higher-arity unions when the underlying
pairwise unions are not declared. Resolves
[#&#8203;7656](https://redirect.github.com/mermaid-js/mermaid/issues/7656).

- Updated dependencies
\[[`ea1c48f`](https://redirect.github.com/mermaid-js/mermaid/commit/ea1c48f53fce5d025388d386c90da8743ee25b13),
[`b4d0442`](https://redirect.github.com/mermaid-js/mermaid/commit/b4d0442dd1628acb3f71681519e7f47fc8bacf55),
[`4e63e9d`](https://redirect.github.com/mermaid-js/mermaid/commit/4e63e9d338b6476df283afd4a002072945bc4563),
[`216e4e9`](https://redirect.github.com/mermaid-js/mermaid/commit/216e4e9a61afceae885b00854f79e17373ccad31)]:
-
[@&#8203;mermaid-js/parser](https://redirect.github.com/mermaid-js/parser)@&#8203;1.2.0

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/toeverything/AFFiNE).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMi4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTIuMCIsInRhcmdldEJyYW5jaCI6ImNhbmFyeSIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=-->

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Assets 16
Loading