CERBERUS/LibreChat
1
0
Fork 0
mirror of https://github.com/danny-avila/LibreChat.git synced 2026-10-23 10:36:09 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 12

🧜‍♀️ chore: Bump mermaid to v11.17.2 and dompurify to v3.4.14 (#15405)

Browse source 
Bumps mermaid 11.16.1 -> 11.17.2, and raises the dompurify override from
3.4.12 to 3.4.14 to clear GHSA-55q2-fjhq-7xh7 (XSS: IN_PLACE hook removal
leaves a detached subtree executable).

The dompurify pin lives under the `monaco-editor` override because monaco
depends on an exact 3.4.8; the override lifts it to match what the rest of
the tree resolves for `^3.4.0`, so a single copy stays hoisted. Bumping it
to 3.4.14 (current latest) keeps that single-copy property — pinning 3.4.13
would have left `^3.4.0` on 3.4.14 and installed two copies.

The mermaid floor moves to ^11.17.2 rather than staying ^11.16.1 because
11.17.0/11.17.1 dropped the `edgePaths` class from rendered SVG, breaking
the flowchart, block and user-journey stylesheets. Restored in 11.17.2.

Lockfile delta is limited to mermaid 11.16.1 -> 11.17.2, @mermaid-js/parser
1.2.0 -> 1.2.1, dompurify 3.4.12 -> 3.4.14, plus new fastdom + strictdom.
katex is unaffected: mermaid raised its floor to ^0.16.47, but the global
`katex: ^0.16.21` override supersedes it, and mermaid only ever calls
`katex.renderToString()`, which 0.16.28 provides.
This commit is contained in:
Danny Avila 2026-08-31 08:01:11 -04:00 • committed by GitHub
parent 044894e8bb
commit e9e77a4b33
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
3 changed files with 32 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

2
client/package.json
View file

@ -86,7 +86,7 @@
"mdast-util-from-markdown": "^2.0.1",
"mdast-util-gfm": "^3.0.0",
"mdast-util-math": "^3.0.0",
"mermaid": "^11.16.1",
"mermaid": "^11.17.2",
"micromark-extension-directive": "^3.0.1",
"micromark-extension-gfm": "^3.0.0",
"micromark-extension-llm-math": "^3.1.0",

44
package-lock.json generated
View file

@ -981,7 +981,7 @@
"mdast-util-from-markdown": "^2.0.1",
"mdast-util-gfm": "^3.0.0",
"mdast-util-math": "^3.0.0",
"mermaid": "^11.16.1",
"mermaid": "^11.17.2",
"micromark-extension-directive": "^3.0.1",
"micromark-extension-gfm": "^3.0.0",
"micromark-extension-llm-math": "^3.1.0",
@ -11328,9 +11328,9 @@
}
},
"node_modules/@mermaid-js/parser": {
"version": "1.2.0",
"resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.0.tgz",
"integrity": "sha512-oYPyv8A4As1yH5Bx+04iQEQxXuIQDe0GKCNSRgao6z8AM9jixXIfP0vsppRLvGf+nKIOb9/LdpWA4YuJiVvESA==",
"version": "1.2.1",
"resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.1.tgz",
"integrity": "sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==",
"license": "MIT",
"dependencies": {
"@chevrotain/types": "~11.1.2"
@ -24555,9 +24555,9 @@
}
},
"node_modules/dompurify": {
"version": "3.4.12",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz",
"integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==",
"version": "3.4.14",
"resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.14.tgz",
"integrity": "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==",
"license": "(MPL-2.0 OR Apache-2.0)",
"optionalDependencies": {
"@types/trusted-types": "^2.0.7"
@ -26184,6 +26184,15 @@
"fxparser": "src/cli/cli.js"
}
},
"node_modules/fastdom": {
"version": "1.0.12",
"resolved": "https://registry.npmjs.org/fastdom/-/fastdom-1.0.12.tgz",
"integrity": "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==",
"license": "MIT",
"dependencies": {
"strictdom": "^1.0.1"
}
},
"node_modules/fastq": {
"version": "1.17.1",
"resolved": "https://registry.npmjs.org/fastq/-/fastq-1.17.1.tgz",
@ -32438,26 +32447,27 @@
}
},
"node_modules/mermaid": {
"version": "11.16.1",
"resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.16.1.tgz",
"integrity": "sha512-TQsq6u22fAn3rek5VOubrhKPo1g5hwC3FXUN9hiyupTckcYiGuuKGkNQrKYwGJkXUxZdojwRG46gsSCFZMDp4g==",
"version": "11.17.2",
"resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.2.tgz",
"integrity": "sha512-V6K3C8EBdEsPFZXSKMJe6ppQOENxuHARr9GvHX4hh47lAbhMRD9qf4oEK7LoaRQxULMa80/qt5gHO73aCleBBg==",
"license": "MIT",
"dependencies": {
"@braintree/sanitize-url": "^7.1.2",
"@iconify/utils": "^3.0.2",
"@mermaid-js/parser": "^1.2.0",
"@mermaid-js/parser": "^1.2.1",
"@types/d3": "^7.4.3",
"@upsetjs/venn.js": "^2.0.0",
"cytoscape": "^3.33.3",
"cytoscape": "^3.34.0",
"cytoscape-cose-bilkent": "^4.1.0",
"cytoscape-fcose": "^2.2.0",
"d3": "^7.9.0",
"d3-sankey": "^0.12.3",
"dagre-d3-es": "7.0.14",
"dayjs": "^1.11.20",
"dayjs": "^1.11.21",
"dompurify": "^3.3.3",
"es-toolkit": "^1.45.1",
"katex": "^0.16.45",
"fastdom": "1.0.12",
"katex": "^0.16.47",
"khroma": "^2.1.0",
"marked": "^16.3.0",
"roughjs": "^4.6.6",
@ -39285,6 +39295,12 @@
"resolved": "https://registry.npmjs.org/strict-event-emitter/-/strict-event-emitter-0.4.6.tgz",
"integrity": "sha512-12KWeb+wixJohmnwNFerbyiBrAlq5qJLwIt38etRtKtmmHyDSoGlIqFE9wx+4IwG0aDjI7GV8tc8ZccjWZZtTg=="
},
"node_modules/strictdom": {
"version": "1.0.1",
"resolved": "https://registry.npmjs.org/strictdom/-/strictdom-1.0.1.tgz",
"integrity": "sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==",
"license": "MIT"
},
"node_modules/string_decoder": {
"version": "1.1.1",
"resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",

2
package.json
View file

@ -227,7 +227,7 @@
"hono": "^4.12.25",
"@hono/node-server": "^2.0.11",
"monaco-editor": {
"dompurify": "3.4.12"
"dompurify": "3.4.14"
},
"test-exclude": "^8.0.0",
"js-yaml": "^4.2.0",