Skip to content

Release candidate 11.14.0 - #7526

Merged
ashishjain0512 merged 283 commits into
masterfrom
release/11.14.0
Apr 1, 2026
Merged

ashishjain0512 merged 283 commits into
masterfrom
release/11.14.0

Conversation

@ashishjain0512

Copy link
Copy Markdown
Collaborator

This pull request introduces several new features and improvements to Mermaid, along with a variety of bug fixes and documentation updates. Notably, it adds support for Wardley Maps as a new diagram type (beta), implements a "neo look" styling for both state and sequence diagrams, and extends the list of recognized diagram keys. Additionally, it includes numerous minor fixes and enhancements across different diagram types and documentation.

New Features and Enhancements:

  • Added Wardley Maps as a new diagram type (beta), supporting component positioning, multiple link types, evolution indicators, custom stages, annotations, and more. This includes parser, renderer, tests, and documentation. (.changeset/add-wardley-maps.md)
  • Implemented "neo look" styling for state diagrams. (.changeset/dirty-dryers-glow.md)
  • Added "neo look" support for sequence diagrams, including drop shadows and enhanced styling. (.changeset/easy-rules-smile.md)
  • Added treeView to the list of recognized diagram keys in MERMAID_CONFIG_DIAGRAM_KEYS. (.build/jsonSchema.ts)

Bug Fixes and Diagram Improvements:

  • Fixed ER diagram parsing when using "1" as an entity identifier on the right side, addressing a parser tokenization issue. (.changeset/fix-7472-er-diagram-parsing-1-identifier.md)
  • Scoped Cytoscape label style mapping to edges with labels to prevent console warnings. (.changeset/fix-architecture-console-warnings.md)

Documentation Updates:

  • Documented valid duration token formats in gantt.md. (.changeset/docs-gantt-duration-format.md)
  • Added a link to the Ishikawa diagram on mermaid.js.org. (.changeset/dirty-regions-start.md)

Other changes include a variety of small bug fixes and improvements to diagram rendering, parsing, and configuration handling.## 📑 Summary

Brief description about the content of your PR.

Resolves #

📏 Design Decisions

Describe the way your implementation works or what design decisions you made if applicable.

📋 Tasks

Make sure you

  • 📖 have read the contribution guidelines
  • 💻 have added necessary unit/e2e tests.
  • 📓 have added documentation. Make sure MERMAID_RELEASE_VERSION is used for all new features.
  • 🦋 If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

tractorjuice and others added 30 commits November 26, 2025 11:02
1. Fix evolution stage parsing to combine name + secondName (e.g., "Genesis / Concept")
2. Fix Evolve rule to accept ID/NAME_WITH_SPACES, not just STRING
3. Fix NAME_WITH_SPACES regex to not match digits after spaces
   - Now matches "Campfire Kettle" but stops at "Kettle" in "Kettle 0.5"
   - Pattern: /[A-Za-z][A-Za-z0-9_()&]*(?:\s+[A-Za-z][A-Za-z0-9_()&]*)*/

This fixes:
- "parses dual-label evolution stages with slashes" test
- "parses evolve statements" test

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Changed \s+ to [ \t]+ in NAME_WITH_SPACES regex to only match spaces
and tabs, not newlines. This prevents the terminal from consuming line
breaks and causing "Expecting NEWLINE or EOF" errors.

Fixes:
- "parses custom evolution stages" test
- "parses dual-label evolution stages with slashes" test

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
1. Pipeline rule now accepts ID/NAME_WITH_SPACES for parent, not just STRING
   - Allows `pipeline Kettle {` without quotes
2. Reorder LINK_PORT alternatives to match longest first (+<> before +< and +>)
   - Fixes bidirectional flow detection (was matching +< instead of +<>)

Fixes:
- "parses pipeline blocks with single-coordinate components" test
- "handles quoted identifiers, inline labels, and converts coordinates to percentages" test

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
1. Label rule now accepts INT with optional minus sign for negative offsets
   - Changed from WARDLEY_NUMBER to INT with negX/negY flags
   - Handle negative values in wardleyParser.ts
2. Link arrow is now optional when LINK_PORT is present
   - Allows syntax like `"Mobile App" +<> API` without explicit arrow

Fixes:
- "parses pipeline blocks with single-coordinate components" test
- "handles quoted identifiers, inline labels, and converts coordinates to percentages" test

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Fixed NAME_WITH_SPACES terminal regex to allow parentheses, digits, and
underscores after spaces. This enables component names like "byte pair
encoding (BPE)" to parse correctly.

Previously, the pattern required letters after spaces which rejected
component names with parentheses like "(BPE)" after spaces.

Changed pattern from:
  (?:[ \t]+[A-Za-z][A-Za-z0-9_()&]*)*
To:
  (?:[ \t]+[A-Za-z0-9_()&]+)*

Fixes E2E test "should render GPT Tokeniser Architecture"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Extended WARDLEY_NUMBER terminal to match both decimals (0.5) and
integers (1, 100) to support annotations syntax like [1, 0].

The previous regex /[0-9]+\.[0-9]+/ only matched decimals, causing
parsing errors for integer coordinates in the annotations statement.

Changed to: /[0-9]+\.[0-9]+|[0-9]+/

Fixes GPT Tokeniser test which uses `annotations [1, 0]`

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Removed unused case handlers for terminals that no longer exist in the
grammar (COMPONENT_NAME, EVOLUTION_NAME, TEXT_UNTIL_BRACKET, TEXT_LINE).
These were remnants from earlier grammar iterations.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Clarified the error message for invalid coordinates to explain that
values can be either 0-1 (decimal, converted to percentage) or 0-100
(percentage, used as-is).

Before: "must be between 0 and 1 (0-100)"
After:  "must be between 0-1 (decimal) or 0-100 (percentage)"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Added `areaWidth` and `areaHeight` configuration options to allow users
to customize the size of area rectangles in Wardley diagrams.

New config options:
- `areaWidth`: Width of area rectangles in pixels (default: 120)
- `areaHeight`: Height of area rectangles in pixels (default: 80)

Example usage:
```
%%{init: {'wardley-beta': {'areaWidth': 150, 'areaHeight': 100}}}%%
wardley-beta
area "My Area" [0.5, 0.5]
```

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
Removed the `area` feature as it is not part of the standard Online
Wardley Maps (OWM) specification. This keeps the implementation aligned
with the official OWM syntax.

Removed:
- `area` grammar rule and KW_AREA terminal
- Area parsing, building, and rendering code
- WardleyArea interface and related types
- areaWidth/areaHeight config options
- Area test case
- Area documentation section

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>
return unchanged arrow function to inline

look at extreme cases

reduce duplication and improve naming

[autofix.ci] apply automated fixes

improve example cases to highlight incongruity

some hacks for easier debugging

wip of removing font width requirement for horizontal out of bar stuff

remove some prior experimentation we don't need anymore

simplified horizontal handling

much simpler methodology seems to work across different examples
… LR GitGraph

The background rectangle for branch labels was misaligned with the text
when branch names contained multi-line text (e.g. "Feature A\n(ongoing)")
in LR layout. The old transform used `pos - bbox.height / 2` which caused
the rect to shift further up as text height increased, while the text
position remained centered at `pos - 1`.

Fixed by using a constant y-offset (`pos - 11`) in the transform,
derived from the constraint that the rect center must equal the text
center regardless of bbox.height.

Closes #7362
…add_tree_view_diagram_update

# Conflicts:
#	.build/jsonSchema.ts
#	demos/index.html
#	docs/config/setup/interfaces/mermaid.MermaidConfig.md
#	docs/config/setup/modules/defaultConfig.md
#	packages/mermaid/src/config.type.ts
#	packages/mermaid/src/defaultConfig.ts
#	packages/mermaid/src/diagram-api/diagram-orchestration.ts
#	packages/mermaid/src/docs/.vitepress/config.ts
#	packages/mermaid/src/mermaidAPI.spec.ts
#	packages/mermaid/src/schemas/config.schema.yaml
#	packages/mermaid/src/styles.spec.ts
#	packages/parser/langium-config.json
#	packages/parser/src/language/index.ts
#	packages/parser/src/parse.ts
lee-treehouse and others added 15 commits March 14, 2026 13:49
Remove files that were accidentally committed and flagged by reviewers:
- PR_READY.md
- PR_SUBMISSION_GUIDE.md
- WARDLEY_MAPS_USER_GUIDE.md
- WARDLEY_MAPS_MEDIUM_GUIDE.md

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
When an edge with a label gets split into two sub-edges (edge-to-label
and edge-from-label) in createGraph.ts, the arrow types were being
hardcoded instead of preserving the original edge's arrow types. This
caused labeled open edges (using --- syntax) to incorrectly show
arrowheads, and bidirectional labeled edges to lose their start arrows.

Now edgeToLabel preserves the original arrowTypeStart and edgeFromLabel
preserves the original arrowTypeEnd, fixing the rendering for all
labeled edge types.

Fixes #6289
…on test

The createGraphWithElements function in createGraph.ts was exported but
never imported anywhere in the codebase. The original fix modified this
dead code path, which had no runtime effect.

The active code path in flowDb.ts already correctly handles arrow_open
edges by setting arrowTypeStart/End to 'none'. No edge splitting occurs
for labeled edges in the dagre layout — labels are rendered as floating
SVG elements positioned at the edge midpoint.

Removed the entire dead code file and kept the Cypress regression test
for open edge arrowhead behavior.
chore: resolve 7484 renovate config typo (take 2)
…ow-types

refactor: remove dead createGraphWithElements code, add open edge regression test
…e_config_option_for_architecture_diagrams

Feature/2833 add randomize config option for architecture diagrams
feat(wardley): Add Wardley Maps diagram type
feature: implement neo look and themes for mermaid diagrams
@changeset-bot

changeset-bot Bot commented Mar 25, 2026 •

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: ea9318a

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
mermaid Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

darshanr0107 and others added 4 commits March 26, 2026 14:03
* changeset-release/master:
  fix pnpm lock file
  Fix: ER diagram edge label positioning (#7453)
  chore: Update coupon
  fix(gantt): restore readable outside-text for done tasks in dark mode (#7456)
  fix(elk): scope rounded edge curve to ELK layout only (#7454)
  Version Packages
  fix: plausible build
  chore: Update plausible
  chore: Update release version in docs
  chore: Track editor picker selection
  fix: update broken docsy link and exclude bot-blocked domains from link checker
  chore: replace MERMAID_RELEASE_VERSION placeholders with current version
  fix: correct package name in changeset slow-lemons-know
  Updated Hero text
  Version Packages
  Fixed issue with hero text
  chore: Update banner with coupon
  Update link with source
  Updating the Hero on the docs side

# Conflicts:
#	.changeset/rounded-edge-curves.md
#	.changeset/weak-tools-pay.md
#	cypress/integration/rendering/flowchart-v2.spec.js
#	packages/mermaid/CHANGELOG.md
#	packages/mermaid/src/rendering-util/createText.ts
#	packages/mermaid/src/rendering-util/rendering-elements/edges.js
#	packages/tiny/CHANGELOG.md
#	pnpm-lock.yaml
…release/11.14.0

* 'release/11.14.0' of github.com:mermaid-js/mermaid:
  fix: apply classDef styles correctly to divider element
@codecov

codecov Bot commented Mar 26, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 1.37204% with 4960 lines in your changes missing coverage. Please review.
✅ Project coverage is 3.34%. Comparing base (547e6d5) to head (19d85ef).
⚠️ Report is 457 commits behind head on master.

Files with missing lines Patch % Lines
...es/mermaid/src/diagrams/wardley/wardleyRenderer.ts 0.00% 857 Missing ⚠️
...d/src/rendering-util/rendering-elements/markers.js 0.00% 492 Missing ⚠️
packages/mermaid/src/themes/theme-neo-dark.js 2.41% 363 Missing ⚠️
packages/mermaid/src/diagrams/sequence/svgDraw.js 0.00% 325 Missing ⚠️
.../src/diagrams/timeline/timelineRendererVertical.ts 0.00% 256 Missing ⚠️
...ages/mermaid/src/diagrams/wardley/wardleyParser.ts 0.54% 182 Missing ⚠️
packages/mermaid/src/diagrams/git/styles.js 0.00% 138 Missing ⚠️
packages/mermaid/src/diagrams/wardley/wardleyDb.ts 0.00% 134 Missing ⚠️
...kages/mermaid/src/diagrams/git/gitGraphRenderer.ts 0.00% 130 Missing ⚠️
packages/mermaid/src/diagrams/treeView/renderer.ts 0.95% 104 Missing ⚠️
... and 121 more
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff            @@
##           master   #7526      +/-   ##
=========================================
- Coverage    3.59%   3.34%   -0.25%     
=========================================
  Files         475     525      +50     
  Lines       47191   55308    +8117     
  Branches      735     795      +60     
=========================================
+ Hits         1696    1850     +154     
- Misses      45495   53458    +7963     
Flag Coverage Δ
unit 3.34% <1.37%> (-0.25%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines Coverage Δ
packages/mermaid/src/config.type.ts 100.00% <ø> (ø)
packages/mermaid/src/defaultConfig.ts 42.66% <100.00%> (+1.90%) ⬆️
packages/mermaid/src/diagram-api/types.ts 100.00% <ø> (ø)
packages/mermaid/src/diagrams/er/erTypes.ts 100.00% <ø> (ø)
packages/mermaid/src/diagrams/treeView/types.ts 100.00% <100.00%> (ø)
...kages/mermaid/src/diagrams/wardley/wardleyTypes.ts 100.00% <100.00%> (ø)
...id/src/diagrams/xychart/chartBuilder/interfaces.ts 10.00% <ø> (ø)
packages/mermaid/src/rendering-util/types.ts 100.00% <ø> (ø)
packages/mermaid/src/themes/index.js 100.00% <100.00%> (ø)
packages/mermaid/src/themes/theme-default.js 95.36% <100.00%> (+0.26%) ⬆️
... and 150 more

... and 22 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

on-behalf-of: @Mermaid-Chart <hello@mermaidchart.com>
@ashishjain0512
ashishjain0512 merged commit efe218a into master Apr 1, 2026
6 of 13 checks passed
@ashishjain0512
ashishjain0512 deleted the release/11.14.0 branch April 1, 2026 08:43
@github-actions github-actions Bot mentioned this pull request Apr 1, 2026
ashishjain0512 added a commit that referenced this pull request Apr 1, 2026
* master: (24 commits)
  Version Packages (#7561)
  Release candidate 11.14.0 (#7526)
  chore: Editor Picker V2 (#7497)
  Setting the link to Get started to the correct on
  Version Packages (#7466)
  fix: use correct package name for elk
  dummy commit
  Fix: ER diagram edge label positioning (#7453)
  chore: Update coupon
  fix(gantt): restore readable outside-text for done tasks in dark mode (#7456)
  fix(elk): scope rounded edge curve to ELK layout only (#7454)
  fix: plausible build
  chore: Update plausible
  chore: Update release version in docs
  chore: Track editor picker selection
  fix: update broken docsy link and exclude bot-blocked domains from link checker
  chore: replace MERMAID_RELEASE_VERSION placeholders with current version
  fix: correct package name in changeset slow-lemons-know
  Updated Hero text
  Version Packages
  ...

# Conflicts:
#	.changeset/weak-tools-pay.md
#	docs/syntax/architecture.md
#	docs/syntax/timeline.md
#	docs/syntax/treeView.md
#	docs/syntax/wardley.md
#	docs/syntax/xyChart.md
#	packages/examples/CHANGELOG.md
#	packages/examples/package.json
#	packages/mermaid/CHANGELOG.md
#	packages/mermaid/package.json
#	packages/mermaid/src/diagrams/git/gitGraphRenderer.ts
#	packages/mermaid/src/docs/.vitepress/components/EditorSelectionModal.vue
#	packages/mermaid/src/docs/syntax/architecture.md
#	packages/mermaid/src/docs/syntax/timeline.md
#	packages/mermaid/src/docs/syntax/treeView.md
#	packages/mermaid/src/docs/syntax/wardley.md
#	packages/mermaid/src/docs/syntax/xyChart.md
#	packages/mermaid/src/rendering-util/rendering-elements/shapes/requirementBox.ts
#	packages/parser/CHANGELOG.md
#	packages/parser/package.json
#	packages/tiny/CHANGELOG.md
#	packages/tiny/package.json
nschloe pushed a commit to live-clones/forgejo that referenced this pull request Apr 5, 2026
This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [mermaid](https://github.com/mermaid-js/mermaid) | [`11.13.0` → `11.14.0`](https://renovatebot.com/diffs/npm/mermaid/11.13.0/11.14.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mermaid/11.14.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mermaid/11.13.0/11.14.0?slim=true) |

---

### Release Notes

<details>
<summary>mermaid-js/mermaid (mermaid)</summary>

### [`v11.14.0`](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.14.0)

[Compare Source](https://github.com/mermaid-js/mermaid/compare/mermaid@11.13.0...mermaid@11.14.0)

Thanks to our awesome mermaid community that contributed to this release: [@&#8203;ashishjain0512](https://github.com/ashishjain0512), [@&#8203;tractorjuice](https://github.com/tractorjuice), [@&#8203;autofix-ci\[bot\]](https://github.com/autofix-ci%5Bbot%5D), [@&#8203;aloisklink](https://github.com/aloisklink), [@&#8203;knsv](https://github.com/knsv), [@&#8203;kibanana](https://github.com/kibanana), [@&#8203;chandershekhar22](https://github.com/chandershekhar22), [@&#8203;khalil](https://github.com/khalil), [@&#8203;ytatsuno](https://github.com/ytatsuno), [@&#8203;sidharthv96](https://github.com/sidharthv96), [@&#8203;github-actions\[bot\]](https://github.com/github-actions%5Bbot%5D), [@&#8203;dripcoding](https://github.com/dripcoding), [@&#8203;knsv-bot](https://github.com/knsv-bot), [@&#8203;jeroensmink98](https://github.com/jeroensmink98), [@&#8203;Alex9583](https://github.com/Alex9583), [@&#8203;GhassenS](https://github.com/GhassenS), [@&#8203;omkarht](https://github.com/omkarht), [@&#8203;darshanr0107](https://github.com/darshanr0107), [@&#8203;leentaylor](https://github.com/leentaylor), [@&#8203;lee-treehouse](https://github.com/lee-treehouse), [@&#8203;veeceey](https://github.com/veeceey), [@&#8203;turntrout](https://github.com/turntrout), [@&#8203;Mermaid-Chart](https://github.com/Mermaid-Chart), [@&#8203;BambioGaming](https://github.com/BambioGaming), Claude

### Releases

#### [@&#8203;mermaid-js/examples](https://github.com/mermaid-js/examples)@&#8203;1.2.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram

#### mermaid\@&#8203;11.14.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Add Wardley Maps diagram type (beta)

  Adds Wardley Maps as a new diagram type to Mermaid (available as `wardley-beta`). Wardley Maps are visual representations of business strategy that help map value chains and component evolution.

  Features:

  - Component positioning with \[visibility, evolution] coordinates (OWM format)
  - Anchors for users/customers
  - Multiple link types: dependencies, flows, labeled links
  - Evolution arrows and trend indicators
  - Custom evolution stages with optional dual labels
  - Custom stage widths using [@&#8203;boundary](https://github.com/boundary) notation
  - Pipeline components with visibility inheritance
  - Annotations, notes, and visual elements
  - Source strategy markers: build, buy, outsource, market
  - Inertia indicators
  - Theme integration

  Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for state diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: add `randomize` config option for architecture diagrams, defaulting to `false` for deterministic layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: Add option to change timeline direction

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like `#arrowhead` should use attribute-ending selectors like `[id$="-arrowhead"]` instead.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for ER diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for requirement diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add theme support for data label colour in xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for mindmap diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look for mermaid flowchart diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look and themes for class diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add showDataLabelOutsideBar option for xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look and themes for gitGraph diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram

##### Patch Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add link to ishikawa diagram on mermaid.js.org

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - docs: document valid duration token formats in gantt.md

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: ER diagram parsing when using "1" as entity identifier on right side

  The parser was incorrectly tokenizing the second "1" in patterns like `a many to 1 1:` because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern `"1"(?=\s+[0-9])` to correctly identify the cardinality alias before a numeric entity name.

  Fixes [#&#8203;7472](mermaid-js/mermaid#7472)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: scope cytoscape label style mapping to edges with labels to prevent console warnings

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: support inline annotation syntax in class diagrams (class Shape <<interface>>)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Align branch label background with text for multi-line labels in LR GitGraph layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: preserve cause hierarchy when ishikawa effect is indented more than causes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Prevent long pie chart titles from being clipped by expanding the viewBox

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: warn when `style` statement targets a non-existent node in flowcharts

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: group state diagram SVG children under single root <g> element

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Allow :::className syntax inside composite state blocks

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) Thanks [@&#8203;aloisklink](https://github.com/aloisklink), [@&#8203;BambioGaming](https://github.com/BambioGaming)! - fix: prevent escaping `<` and `&` when `htmlLabels: false`

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: treemap title and labels use theme-aware colors for dark backgrounds

- Updated dependencies \[[`efe218a`](mermaid-js/mermaid@efe218a)]:
  - [@&#8203;mermaid-js/parser](https://github.com/mermaid-js/parser)@&#8203;1.1.0

#### [@&#8203;mermaid-js/parser](https://github.com/mermaid-js/parser)@&#8203;1.1.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add new TreeView diagram

#### [@&#8203;mermaid-js/tiny](https://github.com/mermaid-js/tiny)@&#8203;11.14.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - Add Wardley Maps diagram type (beta)

  Adds Wardley Maps as a new diagram type to Mermaid (available as `wardley-beta`). Wardley Maps are visual representations of business strategy that help map value chains and component evolution.

  Features:

  - Component positioning with \[visibility, evolution] coordinates (OWM format)
  - Anchors for users/customers
  - Multiple link types: dependencies, flows, labeled links
  - Evolution arrows and trend indicators
  - Custom evolution stages with optional dual labels
  - Custom stage widths using [@&#8203;boundary](https://github.com/boundary) notation
  - Pipeline components with visibility inheritance
  - Annotations, notes, and visual elements
  - Source strategy markers: build, buy, outsource, market
  - Inertia indicators
  - Theme integration

  Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for state diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add `randomize` config option for architecture diagrams, defaulting to `false` for deterministic layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: Add option to change timeline direction

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like `#arrowhead` should use attribute-ending selectors like `[id$="-arrowhead"]` instead.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for ER diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for requirement diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: add theme support for data label colour in xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for mindmap diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look for mermaid flowchart diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look and themes for class diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: add showDataLabelOutsideBar option for xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look and themes for gitGraph diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add new TreeView diagram

##### Patch Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add link to ishikawa diagram on mermaid.js.org

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - docs: document valid duration token formats in gantt.md

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: ER diagram parsing when using "1" as entity identifier on right side

  The parser was incorrectly tokenizing the second "1" in patterns like `a many to 1 1:` because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern `"1"(?=\s+[0-9])` to correctly identify the cardinality alias before a numeric entity name.

  Fixes [#&#8203;7472](mermaid-js/mermaid#7472)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: scope cytoscape label style mapping to edges with labels to prevent console warnings

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: support inline annotation syntax in class diagrams (class Shape <<interface>>)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Align branch label background with text for multi-line labels in LR GitGraph layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: preserve cause hierarchy when ishikawa effect is indented more than causes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Prevent long pie chart titles from being clipped by expanding the viewBox

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: warn when `style` statement targets a non-existent node in flowcharts

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: group state diagram SVG children under single root <g> element

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Allow :::className syntax inside composite state blocks

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) Thanks [@&#8203;aloisklink](https://github.com/aloisklink), [@&#8203;BambioGaming](https://github.com/BambioGaming)! - fix: prevent escaping `<` and `&` when `htmlLabels: false`

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: treemap title and labels use theme-aware colors for dark backgrounds

- Updated dependencies \[[`efe218a`](mermaid-js/mermaid@efe218a)]:
  - [@&#8203;mermaid-js/parser](https://github.com/mermaid-js/parser)@&#8203;1.1.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My45OS4xIiwidXBkYXRlZEluVmVyIjoiNDMuOTkuMSIsInRhcmdldEJyYW5jaCI6ImZvcmdlam8iLCJsYWJlbHMiOlsiZGVwZW5kZW5jeS11cGdyYWRlIiwidGVzdC9ub3QtbmVlZGVkIl19-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/11990
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Co-authored-by: Renovate Bot <bot@kriese.eu>
Co-committed-by: Renovate Bot <bot@kriese.eu>
nschloe pushed a commit to live-clones/forgejo that referenced this pull request May 12, 2026
…531)

This PR contains the following updates:

| Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [mermaid](https://github.com/mermaid-js/mermaid) | [`11.13.0` → `11.15.0`](https://renovatebot.com/diffs/npm/mermaid/11.13.0/11.15.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/mermaid/11.15.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mermaid/11.13.0/11.15.0?slim=true) |

---

### Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS
[CVE-2026-41150](https://nvd.nist.gov/vuln/detail/CVE-2026-41150) / [GHSA-6m6c-36f7-fhxh](GHSA-6m6c-36f7-fhxh)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the [`excludes` attribute](https://mermaid.js.org/syntax/gantt.html?#excludes) to exclude all dates.

Example:

```
gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d
```

`mermaid.parse` is unaffected, unless you then call the `ganttDb.getTasks()` (which is called when rendering a diagram).

##### Patches

This has been patched in:

- [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [faafb5d49106dd32c367f3882505f2dd625aa30e](mermaid-js/mermaid@faafb5d))
- [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a59ea56174712ee5430dfd5bc877cb5151f501a6](mermaid-js/mermaid@a59ea56))

##### Workarounds

There are no workarounds available without updating to a newer version of mermaid.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L`

#### References
- [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh)
- [https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6](https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6)
- [https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e](https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e)
- [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid)
- [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
- [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of configuration leads to CSS injection
[CVE-2026-41159](https://nvd.nist.gov/vuln/detail/CVE-2026-41159) / [GHSA-87f9-hvmw-gh4p](GHSA-87f9-hvmw-gh4p)

<details>
<summary>More information</summary>

#### Details
##### Impact

Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the `fontFamily`, `themeCSS`, and `altFontFamily` configuration options.

Live demo: [mermaid.live](https://mermaid.live/edit#pako:eNpNjktLxDAUhf9KvFBR6JS-60QQfODKlUvJ5k6TtsEmKTHFGUP-u-mI6Nmdy3fOPR56wwVQSBIvtXSUeAaD0e4ZlZxPDChhcLxFfwiEauOuLq_9Afv30ZpVczpaITS5kGox1qF2gfSeBwYhJAnThAyz-ewntI68vG5-0z3Z7e7IA9OQwmglB-rsKlJQwircLPgNZeAmocTPAi4GXGfHgOkQYwvqN2PUbzJuGSegA84f0a0LRyeeJI4W_xChubCPcbQD2pwbgHo4Aq2aKmvbqq3zoiu7pizqFE6RybN9VFfFY1HWXRVS-Dr_zLObrt7_V_gGGXZlGg)

Example code:

```
%%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%%
flowchart LR
    A --> B
```

The injected CSS exploits stylis's `&` (scope reference) handling. `:not(&)` escapes the `#mermaid-xxx` automatic scoping, applying styles to all page elements. Global at-rules (`@font-face`, `@keyframes`, `@counter-style`) are also injectable as stylis hoists them to top level.

This allows page defacement and DOM attribute exfiltration via CSS `:has()` selectors.

##### Patches

- [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [64769738d5b59211e1decb471ffbaca8afec51aa](mermaid-js/mermaid@6476973))
- [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a9d9f0d8eb790349121508688cd338253fd80d76](mermaid-js/mermaid@a9d9f0d))

##### Workarounds

If you can't upgrade mermaid, you can set the [`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure) config value in the mermaid config to avoid allowing diagrams to modify `fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`.

Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)  will also prevent this.

##### Credits

Reported by @&#8203;zsxsoft on behalf of @&#8203;KeenSecurityLab

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
- [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p)
- [https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa](https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa)
- [https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76](https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76)
- [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid)
- [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
- [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection
[CVE-2026-41149](https://nvd.nist.gov/vuln/detail/CVE-2026-41149) / [GHSA-ghcm-xqfw-q4vr](GHSA-ghcm-xqfw-q4vr)

<details>
<summary>More information</summary>

#### Details
##### Impact

Under the default configuration, Mermaid state diagram's `classDef` allow DOM injection that escapes the SVG, although `<script>` tags are removed, preventing XSS.

##### Proof-of-concept

```
stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss
```

##### Patches

- [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [37ff937f1da2e19f882fd1db01235db4d01f4056](mermaid-js/mermaid@37ff937))
- [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](mermaid-js/mermaid@4e2d512))

##### Workarounds

If you can not update to a patched version, setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)  will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`.

##### Credits

Thanks to @&#8203;zsxsoft from @&#8203;KeenSecurityLab for reporting this vulnerability.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
- [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr)
- [https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056](https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056)
- [https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3)
- [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid)
- [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
- [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
- [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-ghcm-xqfw-q4vr) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection
[CVE-2026-41148](https://nvd.nist.gov/vuln/detail/CVE-2026-41148) / [GHSA-xcj9-5m2h-648r](GHSA-xcj9-5m2h-648r)

<details>
<summary>More information</summary>

#### Details
##### Details

The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures `classDef` values with an unrestricted regex:

```jison
// packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83
<CLASSDEFID>[^\n]*   { this.popState(); return 'CLASSDEF_STYLEOPTS' }
```

The value passes unsanitized through `addStyleClass()` -> `createCssStyles()` -> `style.innerHTML` (mermaidAPI.ts:418). A `}` in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page.

##### PoC

```
stateDiagram-v2
      classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")}
```

Live demo:
<https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU>

##### Patches

This has been patched in:

- [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [e9b0f34d8d82a6260077764ee45e1d7d90957a0f](mermaid-js/mermaid@e9b0f34))
- [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [8fead23c59166b7bab6a39eac81acebee2859102](mermaid-js/mermaid@8fead23))

##### Workarounds

Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)  will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`.

##### Impact

 Enables page defacement, user tracking via `url()` callbacks, and DOM attribute exfiltration via CSS `:has()` selectors.

#### Severity
- CVSS Score: 5.3 / 10 (Medium)
- Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L`

#### References
- [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r)
- [https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102](https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102)
- [https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f](https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f)
- [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid)
- [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)
- [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6)
- [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel)

This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xcj9-5m2h-648r) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)).
</details>

---

### Release Notes

<details>
<summary>mermaid-js/mermaid (mermaid)</summary>

### [`v11.15.0`](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0)

[Compare Source](https://github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0)

##### Minor Changes

- [#&#8203;7174](mermaid-js/mermaid#7174) [`0aca217`](mermaid-js/mermaid@0aca217) Thanks [@&#8203;milesspencer35](https://github.com/milesspencer35)! - feat(sequence): Add support for decimal start and increment values in the `autonumber` directive

- [#&#8203;7512](mermaid-js/mermaid#7512) [`8e17492`](mermaid-js/mermaid@8e17492) Thanks [@&#8203;aruncveli](https://github.com/aruncveli)! - feat(flowchart): add datastore shape

  In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with `A@{ shape: datastore, label: "Datastore" }`.

- [#&#8203;6440](mermaid-js/mermaid#6440) [`9ad8dde`](mermaid-js/mermaid@9ad8dde) Thanks [@&#8203;yordis](https://github.com/yordis), [@&#8203;lgazo](https://github.com/lgazo)! - feat: add Event Modeling diagram

- [#&#8203;7707](mermaid-js/mermaid#7707) [`27db774`](mermaid-js/mermaid@27db774) Thanks [@&#8203;txmxthy](https://github.com/txmxthy)! - feat(architecture): expose four fcose layout knobs for `architecture-beta` diagrams (`nodeSeparation`, `idealEdgeLengthMultiplier`, `edgeElasticity`, `numIter`) so authors can tune layout density and spread overlapping siblings without changing diagram source

- [#&#8203;7604](mermaid-js/mermaid#7604) [`bf9502f`](mermaid-js/mermaid@bf9502f) Thanks [@&#8203;M-a-c](https://github.com/M-a-c)! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting

  If you have namespaces in class diagrams that use `.`s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set `class.hierarchicalNamespaces=false` in your mermaid config:

  ```yaml
  config:
    class:
      hierarchicalNamespaces: false
  ```

- [#&#8203;7272](mermaid-js/mermaid#7272) [`88cdd3d`](mermaid-js/mermaid@88cdd3d) Thanks [@&#8203;xinbenlv](https://github.com/xinbenlv)! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors

##### Patch Changes

- [#&#8203;7737](mermaid-js/mermaid#7737) [`e9b0f34`](mermaid-js/mermaid@e9b0f34) Thanks [@&#8203;ashishjain0512](https://github.com/ashishjain0512)! - fix: prevent unbalanced CSS styles in classDefs

- [#&#8203;7737](mermaid-js/mermaid#7737) [`37ff937`](mermaid-js/mermaid@37ff937) Thanks [@&#8203;ashishjain0512](https://github.com/ashishjain0512)! - fix: create CSS styles using the CSSOM

  This removes some invalid CSS and normalizes some CSS formatting.

- [#&#8203;7508](mermaid-js/mermaid#7508) [`bfe60cc`](mermaid-js/mermaid@bfe60cc) Thanks [@&#8203;biiab](https://github.com/biiab)! - fix(stateDiagram): `end note` now only closes a note when used on a new line

- [#&#8203;7737](mermaid-js/mermaid#7737) [`faafb5d`](mermaid-js/mermaid@faafb5d) Thanks [@&#8203;ashishjain0512](https://github.com/ashishjain0512)! - fix(gantt): add iteration limit for `excludes` field

- [#&#8203;7737](mermaid-js/mermaid#7737) [`65f8be2`](mermaid-js/mermaid@65f8be2) Thanks [@&#8203;ashishjain0512](https://github.com/ashishjain0512)! - fix: disallow some CSS at-rules in custom CSS

- [#&#8203;7726](mermaid-js/mermaid#7726) [`1502f32`](mermaid-js/mermaid@1502f32) Thanks [@&#8203;aloisklink](https://github.com/aloisklink)! - fix(wardley): fix unnecessary sanitization of text

- [#&#8203;7578](mermaid-js/mermaid#7578) [`1f98db8`](mermaid-js/mermaid@1f98db8) Thanks [@&#8203;Gaston202](https://github.com/Gaston202)! - fix(class): self-referential class multiplicity labels no longer rendered multiple times

  Fixes [#&#8203;7560](mermaid-js/mermaid#7560). Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.

- [#&#8203;7592](mermaid-js/mermaid#7592) [`2343e38`](mermaid-js/mermaid@2343e38) Thanks [@&#8203;knsv-bot](https://github.com/knsv-bot)! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams

- [#&#8203;7589](mermaid-js/mermaid#7589) [`7fb9509`](mermaid-js/mermaid@7fb9509) Thanks [@&#8203;NYCU-Chung](https://github.com/NYCU-Chung)! - fix(block): prevent column widths from shrinking when mixing different column spans

- [#&#8203;7632](mermaid-js/mermaid#7632) [`3f9e0f1`](mermaid-js/mermaid@3f9e0f1) Thanks [@&#8203;ekiauhce](https://github.com/ekiauhce)! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams

- [#&#8203;7642](mermaid-js/mermaid#7642) [`7a8fb85`](mermaid-js/mermaid@7a8fb85) Thanks [@&#8203;tractorjuice](https://github.com/tractorjuice)! - fix(wardley): allow hyphens in unquoted component names

  Multi-word names containing hyphens — e.g. `real-time processing`, `end-user`, `on-call engineer` — now parse without quoting, bringing the grammar in line with the OnlineWardleyMaps (OWM) convention. `A->B` (no-space arrow) still tokenises correctly.

- [#&#8203;7523](mermaid-js/mermaid#7523) [`5144ed4`](mermaid-js/mermaid@5144ed4) Thanks [@&#8203;darshanr0107](https://github.com/darshanr0107)! - fix(block): Arrow blocks in block-beta diagrams not spanning the specified number of columns when using `:n` syntax.

- [#&#8203;7262](mermaid-js/mermaid#7262) [`13d9bfa`](mermaid-js/mermaid@13d9bfa) Thanks [@&#8203;darshanr0107](https://github.com/darshanr0107)! - fix(block): Ensure block diagram hexagon blocks respect column spanning syntax

- [#&#8203;7684](mermaid-js/mermaid#7684) [`e14bb88`](mermaid-js/mermaid@e14bb88) Thanks [@&#8203;aloisklink](https://github.com/aloisklink)! - fix: loosen `uuid` dependency range to allow v14

  Mermaid does not use any of the vulnerable code in CVE-2026-41907,
  but this allows users to silence any `npm audit` alerts on it.

- [#&#8203;7633](mermaid-js/mermaid#7633) [`9217c0d`](mermaid-js/mermaid@9217c0d) Thanks [@&#8203;Felix-Garci](https://github.com/Felix-Garci)! - fix(block): add support for all arrow types in block diagrams

- [#&#8203;7587](mermaid-js/mermaid#7587) [`5e7eb62`](mermaid-js/mermaid@5e7eb62) Thanks [@&#8203;MaddyGuthridge](https://github.com/MaddyGuthridge)! - chore: drop lodash-es in favour of es-toolkit

- [#&#8203;7693](mermaid-js/mermaid#7693) [`afaf306`](mermaid-js/mermaid@afaf306) Thanks [@&#8203;dull-bird](https://github.com/dull-bird)! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels.

  Previously the lexer only matched ASCII `[A-Za-z]+` for text tokens, even though the grammar referenced `UNICODE_TEXT`. Bare Chinese, Japanese, Korean, emoji, and accented Latin characters in labels caused a parse error. Added a `[^\x00-\x7F]+` lexer rule to emit `UNICODE_TEXT` and included it in the `alphaNumToken` grammar rule.

  Fixes [#&#8203;7120](mermaid-js/mermaid#7120).

- [#&#8203;7737](mermaid-js/mermaid#7737) [`4755553`](mermaid-js/mermaid@4755553) Thanks [@&#8203;ashishjain0512](https://github.com/ashishjain0512)! - fix: improve D3 types for mermaidAPI funcs

- [#&#8203;7737](mermaid-js/mermaid#7737) [`6476973`](mermaid-js/mermaid@6476973) Thanks [@&#8203;ashishjain0512](https://github.com/ashishjain0512)! - fix: handle `&` when namespacing CSS rules

- [#&#8203;7520](mermaid-js/mermaid#7520) [`8c1a0c1`](mermaid-js/mermaid@8c1a0c1) Thanks [@&#8203;RodrigojndSantos](https://github.com/RodrigojndSantos)! - fix(stateDiagram): comments starting with one `%` are no longer treated as comments

  Switch to using two `%%` if you want to write a comment.

- Updated dependencies \[[`7a8fb85`](mermaid-js/mermaid@7a8fb85), [`675a64c`](mermaid-js/mermaid@675a64c)]:
  - [@&#8203;mermaid-js/parser](https://github.com/mermaid-js/parser)@&#8203;1.1.1

### [`v11.14.0`](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.14.0)

[Compare Source](https://github.com/mermaid-js/mermaid/compare/mermaid@11.13.0...mermaid@11.14.0)

Thanks to our awesome mermaid community that contributed to this release: [@&#8203;ashishjain0512](https://github.com/ashishjain0512), [@&#8203;tractorjuice](https://github.com/tractorjuice), [@&#8203;autofix-ci\[bot\]](https://github.com/autofix-ci%5Bbot%5D), [@&#8203;aloisklink](https://github.com/aloisklink), [@&#8203;knsv](https://github.com/knsv), [@&#8203;kibanana](https://github.com/kibanana), [@&#8203;chandershekhar22](https://github.com/chandershekhar22), [@&#8203;khalil](https://github.com/khalil), [@&#8203;ytatsuno](https://github.com/ytatsuno), [@&#8203;sidharthv96](https://github.com/sidharthv96), [@&#8203;github-actions\[bot\]](https://github.com/github-actions%5Bbot%5D), [@&#8203;dripcoding](https://github.com/dripcoding), [@&#8203;knsv-bot](https://github.com/knsv-bot), [@&#8203;jeroensmink98](https://github.com/jeroensmink98), [@&#8203;Alex9583](https://github.com/Alex9583), [@&#8203;GhassenS](https://github.com/GhassenS), [@&#8203;omkarht](https://github.com/omkarht), [@&#8203;darshanr0107](https://github.com/darshanr0107), [@&#8203;leentaylor](https://github.com/leentaylor), [@&#8203;lee-treehouse](https://github.com/lee-treehouse), [@&#8203;veeceey](https://github.com/veeceey), [@&#8203;turntrout](https://github.com/turntrout), [@&#8203;Mermaid-Chart](https://github.com/Mermaid-Chart), [@&#8203;BambioGaming](https://github.com/BambioGaming), Claude

### Releases

#### [@&#8203;mermaid-js/examples](https://github.com/mermaid-js/examples)@&#8203;1.2.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram

#### mermaid\@&#8203;11.14.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Add Wardley Maps diagram type (beta)

  Adds Wardley Maps as a new diagram type to Mermaid (available as `wardley-beta`). Wardley Maps are visual representations of business strategy that help map value chains and component evolution.

  Features:

  - Component positioning with \[visibility, evolution] coordinates (OWM format)
  - Anchors for users/customers
  - Multiple link types: dependencies, flows, labeled links
  - Evolution arrows and trend indicators
  - Custom evolution stages with optional dual labels
  - Custom stage widths using [@&#8203;boundary](https://github.com/boundary) notation
  - Pipeline components with visibility inheritance
  - Annotations, notes, and visual elements
  - Source strategy markers: build, buy, outsource, market
  - Inertia indicators
  - Theme integration

  Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for state diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: add `randomize` config option for architecture diagrams, defaulting to `false` for deterministic layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: Add option to change timeline direction

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like `#arrowhead` should use attribute-ending selectors like `[id$="-arrowhead"]` instead.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for ER diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for requirement diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add theme support for data label colour in xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for mindmap diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look for mermaid flowchart diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look and themes for class diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add showDataLabelOutsideBar option for xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look and themes for gitGraph diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram

##### Patch Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add link to ishikawa diagram on mermaid.js.org

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - docs: document valid duration token formats in gantt.md

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: ER diagram parsing when using "1" as entity identifier on right side

  The parser was incorrectly tokenizing the second "1" in patterns like `a many to 1 1:` because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern `"1"(?=\s+[0-9])` to correctly identify the cardinality alias before a numeric entity name.

  Fixes [#&#8203;7472](mermaid-js/mermaid#7472)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: scope cytoscape label style mapping to edges with labels to prevent console warnings

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: support inline annotation syntax in class diagrams (class Shape <<interface>>)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Align branch label background with text for multi-line labels in LR GitGraph layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: preserve cause hierarchy when ishikawa effect is indented more than causes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Prevent long pie chart titles from being clipped by expanding the viewBox

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: warn when `style` statement targets a non-existent node in flowcharts

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: group state diagram SVG children under single root <g> element

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Allow :::className syntax inside composite state blocks

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) Thanks [@&#8203;aloisklink](https://github.com/aloisklink), [@&#8203;BambioGaming](https://github.com/BambioGaming)! - fix: prevent escaping `<` and `&` when `htmlLabels: false`

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: treemap title and labels use theme-aware colors for dark backgrounds

- Updated dependencies \[[`efe218a`](mermaid-js/mermaid@efe218a)]:
  - [@&#8203;mermaid-js/parser](https://github.com/mermaid-js/parser)@&#8203;1.1.0

#### [@&#8203;mermaid-js/parser](https://github.com/mermaid-js/parser)@&#8203;1.1.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add new TreeView diagram

#### [@&#8203;mermaid-js/tiny](https://github.com/mermaid-js/tiny)@&#8203;11.14.0

##### Minor Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - Add Wardley Maps diagram type (beta)

  Adds Wardley Maps as a new diagram type to Mermaid (available as `wardley-beta`). Wardley Maps are visual representations of business strategy that help map value chains and component evolution.

  Features:

  - Component positioning with \[visibility, evolution] coordinates (OWM format)
  - Anchors for users/customers
  - Multiple link types: dependencies, flows, labeled links
  - Evolution arrows and trend indicators
  - Custom evolution stages with optional dual labels
  - Custom stage widths using [@&#8203;boundary](https://github.com/boundary) notation
  - Pipeline components with visibility inheritance
  - Annotations, notes, and visual elements
  - Source strategy markers: build, buy, outsource, market
  - Inertia indicators
  - Theme integration

  Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for state diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add `randomize` config option for architecture diagrams, defaulting to `false` for deterministic layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: Add option to change timeline direction

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like `#arrowhead` should use attribute-ending selectors like `[id$="-arrowhead"]` instead.

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for ER diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for requirement diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: add theme support for data label colour in xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look styling for mindmap diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look for mermaid flowchart diagrams

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look and themes for class diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: add showDataLabelOutsideBar option for xy chart

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - feat: implement neo look and themes for gitGraph diagram

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add new TreeView diagram

##### Patch Changes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - add link to ishikawa diagram on mermaid.js.org

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - docs: document valid duration token formats in gantt.md

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: ER diagram parsing when using "1" as entity identifier on right side

  The parser was incorrectly tokenizing the second "1" in patterns like `a many to 1 1:` because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern `"1"(?=\s+[0-9])` to correctly identify the cardinality alias before a numeric entity name.

  Fixes [#&#8203;7472](mermaid-js/mermaid#7472)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: scope cytoscape label style mapping to edges with labels to prevent console warnings

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: support inline annotation syntax in class diagrams (class Shape <<interface>>)

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Align branch label background with text for multi-line labels in LR GitGraph layout

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: preserve cause hierarchy when ishikawa effect is indented more than causes

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Prevent long pie chart titles from being clipped by expanding the viewBox

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: warn when `style` statement targets a non-existent node in flowcharts

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: group state diagram SVG children under single root <g> element

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: Allow :::className syntax inside composite state blocks

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) Thanks [@&#8203;aloisklink](https://github.com/aloisklink), [@&#8203;BambioGaming](https://github.com/BambioGaming)! - fix: prevent escaping `<` and `&` when `htmlLabels: false`

- [#&#8203;7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a)  - fix: treemap title and labels use theme-aware colors for dark backgrounds

- Updated dependencies \[[`efe218a`](mermaid-js/mermaid@efe218a)]:
  - [@&#8203;mermaid-js/parser](https://github.com/mermaid-js/parser)@&#8203;1.1.0

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - ""
- Automerge
  - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ0YXJnZXRCcmFuY2giOiJ2MTUuMC9mb3JnZWpvIiwibGFiZWxzIjpbImRlcGVuZGVuY3ktdXBncmFkZSIsInRlc3Qvbm90LW5lZWRlZCJdfQ==-->

Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12531
Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.