From e9e77a4b334c438d2206adf57a369afbd2b9d849 Mon Sep 17 00:00:00 2001 From: Danny Avila Date: Mon, 31 Aug 2026 08:01:11 -0400 Subject: [PATCH] =?UTF-8?q?=F0=9F=A7=9C=E2=80=8D=E2=99=80=EF=B8=8F=20chore?= =?UTF-8?q?:=20Bump=20`mermaid`=20to=20v11.17.2=20and=20`dompurify`=20to?= =?UTF-8?q?=20v3.4.14=20(#15405)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bumps mermaid 11.16.1 -> 11.17.2, and raises the dompurify override from 3.4.12 to 3.4.14 to clear GHSA-55q2-fjhq-7xh7 (XSS: IN_PLACE hook removal leaves a detached subtree executable). The dompurify pin lives under the `monaco-editor` override because monaco depends on an exact 3.4.8; the override lifts it to match what the rest of the tree resolves for `^3.4.0`, so a single copy stays hoisted. Bumping it to 3.4.14 (current latest) keeps that single-copy property — pinning 3.4.13 would have left `^3.4.0` on 3.4.14 and installed two copies. The mermaid floor moves to ^11.17.2 rather than staying ^11.16.1 because 11.17.0/11.17.1 dropped the `edgePaths` class from rendered SVG, breaking the flowchart, block and user-journey stylesheets. Restored in 11.17.2. Lockfile delta is limited to mermaid 11.16.1 -> 11.17.2, @mermaid-js/parser 1.2.0 -> 1.2.1, dompurify 3.4.12 -> 3.4.14, plus new fastdom + strictdom. katex is unaffected: mermaid raised its floor to ^0.16.47, but the global `katex: ^0.16.21` override supersedes it, and mermaid only ever calls `katex.renderToString()`, which 0.16.28 provides. --- client/package.json | 2 +- package-lock.json | 44 ++++++++++++++++++++++++++++++-------------- package.json | 2 +- 3 files changed, 32 insertions(+), 16 deletions(-) diff --git a/client/package.json b/client/package.json index a9628abdbc..d5791f5bfe 100644 --- a/client/package.json +++ b/client/package.json @@ -86,7 +86,7 @@ "mdast-util-from-markdown": "^2.0.1", "mdast-util-gfm": "^3.0.0", "mdast-util-math": "^3.0.0", - "mermaid": "^11.16.1", + "mermaid": "^11.17.2", "micromark-extension-directive": "^3.0.1", "micromark-extension-gfm": "^3.0.0", "micromark-extension-llm-math": "^3.1.0", diff --git a/package-lock.json b/package-lock.json index d0fd247c94..0d0734d1ca 100644 --- a/package-lock.json +++ b/package-lock.json @@ -981,7 +981,7 @@ "mdast-util-from-markdown": "^2.0.1", "mdast-util-gfm": "^3.0.0", "mdast-util-math": "^3.0.0", - "mermaid": "^11.16.1", + "mermaid": "^11.17.2", "micromark-extension-directive": "^3.0.1", "micromark-extension-gfm": "^3.0.0", "micromark-extension-llm-math": "^3.1.0", @@ -11328,9 +11328,9 @@ } }, "node_modules/@mermaid-js/parser": { - "version": "1.2.0", - "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.0.tgz", - "integrity": "sha512-oYPyv8A4As1yH5Bx+04iQEQxXuIQDe0GKCNSRgao6z8AM9jixXIfP0vsppRLvGf+nKIOb9/LdpWA4YuJiVvESA==", + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.1.tgz", + "integrity": "sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==", "license": "MIT", "dependencies": { "@chevrotain/types": "~11.1.2" @@ -24555,9 +24555,9 @@ } }, "node_modules/dompurify": { - "version": "3.4.12", - "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.12.tgz", - "integrity": "sha512-zQvGet8Z2sWbQhCmfFz/T5QWH2oBmjnqK3qvOjaqaNLrLEF912WamU+ohnTp0TCep/MFVHpdJuCZEdFOdTnEFg==", + "version": "3.4.14", + "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.4.14.tgz", + "integrity": "sha512-dVoH9z+MY+C9IilgGCk3YfFqjLi3fChm2OiKJMzh6axrJ5qwxqWaZamgmHrpv22CN/KdbZJuGEGgfQoL00LTdg==", "license": "(MPL-2.0 OR Apache-2.0)", "optionalDependencies": { "@types/trusted-types": "^2.0.7" @@ -26184,6 +26184,15 @@ "fxparser": "src/cli/cli.js" } }, + "node_modules/fastdom": { + "version": "1.0.12", + "resolved": "https://registry.npmjs.org/fastdom/-/fastdom-1.0.12.tgz", + "integrity": "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==", + "license": "MIT", + "dependencies": { + "strictdom": "^1.0.1" + } + }, "node_modules/fastq": { "version": "1.17.1", "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.17.1.tgz", @@ -32438,26 +32447,27 @@ } }, "node_modules/mermaid": { - "version": "11.16.1", - "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.16.1.tgz", - "integrity": "sha512-TQsq6u22fAn3rek5VOubrhKPo1g5hwC3FXUN9hiyupTckcYiGuuKGkNQrKYwGJkXUxZdojwRG46gsSCFZMDp4g==", + "version": "11.17.2", + "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.2.tgz", + "integrity": "sha512-V6K3C8EBdEsPFZXSKMJe6ppQOENxuHARr9GvHX4hh47lAbhMRD9qf4oEK7LoaRQxULMa80/qt5gHO73aCleBBg==", "license": "MIT", "dependencies": { "@braintree/sanitize-url": "^7.1.2", "@iconify/utils": "^3.0.2", - "@mermaid-js/parser": "^1.2.0", + "@mermaid-js/parser": "^1.2.1", "@types/d3": "^7.4.3", "@upsetjs/venn.js": "^2.0.0", - "cytoscape": "^3.33.3", + "cytoscape": "^3.34.0", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", - "dayjs": "^1.11.20", + "dayjs": "^1.11.21", "dompurify": "^3.3.3", "es-toolkit": "^1.45.1", - "katex": "^0.16.45", + "fastdom": "1.0.12", + "katex": "^0.16.47", "khroma": "^2.1.0", "marked": "^16.3.0", "roughjs": "^4.6.6", @@ -39285,6 +39295,12 @@ "resolved": "https://registry.npmjs.org/strict-event-emitter/-/strict-event-emitter-0.4.6.tgz", "integrity": "sha512-12KWeb+wixJohmnwNFerbyiBrAlq5qJLwIt38etRtKtmmHyDSoGlIqFE9wx+4IwG0aDjI7GV8tc8ZccjWZZtTg==" }, + "node_modules/strictdom": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/strictdom/-/strictdom-1.0.1.tgz", + "integrity": "sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==", + "license": "MIT" + }, "node_modules/string_decoder": { "version": "1.1.1", "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz", diff --git a/package.json b/package.json index 44ad89c799..ccb872bd9e 100644 --- a/package.json +++ b/package.json @@ -227,7 +227,7 @@ "hono": "^4.12.25", "@hono/node-server": "^2.0.11", "monaco-editor": { - "dompurify": "3.4.12" + "dompurify": "3.4.14" }, "test-exclude": "^8.0.0", "js-yaml": "^4.2.0",