Release Candidate 11.15.0 - #7737
Merged
Merged
Conversation
on-behalf-of: @Mermaid-Chart <hello@mermaidchart.com>
feature: implement neo look and themes for mermaid diagrams
�[1mMERMAID LOCAL DOCKER DEVELOPMENT�[0m
Welcome! Thank you for joining the development.
This is a script for running commands within docker containers at ease.
__________________________________________________________________________________________
Development Quick Start Guide:
�[1m./run pnpm install�[0m # Install packages
�[1m./run dev�[0m # Launch dev server with examples, open http://localhost:9000
�[1m./run docs:dev�[0m # Launch official website, open http://localhost:3333
�[1m./run pnpm vitest�[0m # Run watcher for unit tests
�[1m./run cypress�[0m # Run integration tests (after starting dev server)
�[1m./run pnpm build�[0m # Prepare it for production
__________________________________________________________________________________________
Commands:
�[1m./run build�[0m # Build image
�[1m./run cypress�[0m # Run integration tests
�[1m./run dev�[0m # Run dev server with examples, open http://localhost:9000
�[1m./run docs:dev�[0m # For docs contributions, open http://localhost:3333
�[1m./run help�[0m # Show this help
�[1m./run pnpm�[0m # Run any 'pnpm' command
�[1m./run sh�[0m # Open 'sh' inside docker container for development
__________________________________________________________________________________________
Examples of frequently used commands:
�[1m./run pnpm add --filter mermaid�[0m �[4mpackage�[0m
Add package to mermaid
�[1m./run pnpm -w run lint:fix�[0m
Run prettier and ES lint
�[1mgit diff --name-only develop | xargs ./run pnpm prettier --write�[0m
Prettify everything you added so far
�[1m./run cypress open --project .�[0m
Open cypress interactive GUI
�[1m./run cypress run --spec cypress/integration/rendering/�[0m�[4mtest.spec.ts�[0m
Run specific test in cypress
�[1mxhost +local:�[0m
Allow local connections for x11 server or
�[1mMERMAID LOCAL DOCKER DEVELOPMENT�[0m
Welcome! Thank you for joining the development.
This is a script for running commands within docker containers at ease.
__________________________________________________________________________________________
Development Quick Start Guide:
�[1m./run pnpm install�[0m # Install packages
�[1m./run dev�[0m # Launch dev server with examples, open http://localhost:9000
�[1m./run docs:dev�[0m # Launch official website, open http://localhost:3333
�[1m./run pnpm vitest�[0m # Run watcher for unit tests
�[1m./run cypress�[0m # Run integration tests (after starting dev server)
�[1m./run pnpm build�[0m # Prepare it for production
__________________________________________________________________________________________
Commands:
�[1m./run build�[0m # Build image
�[1m./run cypress�[0m # Run integration tests
�[1m./run dev�[0m # Run dev server with examples, open http://localhost:9000
�[1m./run docs:dev�[0m # For docs contributions, open http://localhost:3333
�[1m./run help�[0m # Show this help
�[1m./run pnpm�[0m # Run any 'pnpm' command
�[1m./run sh�[0m # Open 'sh' inside docker container for development
__________________________________________________________________________________________
Examples of frequently used commands:
�[1m./run pnpm add --filter mermaid�[0m �[4mpackage�[0m
Add package to mermaid
�[1m./run pnpm -w run lint:fix�[0m
Run prettier and ES lint
�[1mgit diff --name-only develop | xargs ./run pnpm prettier --write�[0m
Prettify everything you added so far
�[1m./run cypress open --project .�[0m
Open cypress interactive GUI
�[1m./run cypress run --spec cypress/integration/rendering/�[0m�[4mtest.spec.ts�[0m
Run specific test in cypress
�[1mxhost +local:�[0m
Allow local connections for x11 server output
Add explicit test cases for special characters (single quotes, ampersands, forward slashes, and hyphens) in Sankey diagram node names. These tests verify the fix for issue #7528 where special characters in node names like 'Agricultural \'waste\'', 'Lighting & appliances', and 'Over generation / exports' are correctly parsed. The tests confirm that both 'sankey' and 'sankey-beta' syntax properly handle these characters in CSV-style diagram definitions.
- Implement collapsible nodes with recursive pruning - Auto-zoom layout to fill canvas when nodes are hidden - Strict CSV order sorting for stable node positions - Target-based link coloring with transparency and blend mode - Smart indicator icons (only shown when collapsed) - Smooth fade animations for enter/exit transitions
- Add precomputed topology to identify central node (max flow) - Central node (Revenue) can collapse both left and right sides - Other nodes can only collapse their children direction - Auto-zoom: remaining nodes expand to fill canvas after collapse - Collapse animation: nodes shrink towards anchor, expand from anchor - Central node is 1.5x wider for visual emphasis - Indicators show collapse state with directional arrows
…node colors - Add smart label positioning based on node layer relative to central node - Add outlined label style (labelStyle: 'outlined') as new default - Add nodeColors config option for custom node color mapping - Add configurable nodeWidth and nodePadding options - Update styles.js with new CSS for outlined labels - Fix YAML frontmatter indentation in demos/sankey.html - Add Cypress tests for new features BREAKING CHANGE: labelStyle now defaults to 'outlined' instead of 'default'
- Rename labelStyle 'outlined' to 'default' (new default behavior) - Rename labelStyle 'default' to 'legacy' (original behavior) - Remove demo-sankey.html (demonstration file only) - Update tests, demo, and renderer for new naming
…ocs build The curly braces in the YAML description were being parsed as Vue template syntax, causing a 'Duplicate attribute' error during vitepress docs build.
- Restore SankeyLinkColor gradient meta:enum and default that were accidentally deleted - Rename labelStyle 'default' to 'outlined', default to 'legacy' (non-breaking) - Restore original position-based label positioning for legacy mode - Validate nodeColors values as CSS colors in sanitizeDirective - Use theme variables instead of hardcoded colors in styles.js - Add changeset
… options - Improve type safety: use SankeyNodeWithLayer interface for findCentralNodeLayer - Reduce code duplication: extract appendLabel helper for D3 label chains - Add documentation for labelStyle, nodeWidth, nodePadding, and nodeColors
d3SankeyNode.value is number | undefined - add nullish coalescing to fix TS errors.
Add an iteration limit to `fixTaskDates` to prevent infinite loops (i.e. when `excludes` is used to exclude every possible date). I've picked 10k days, in case some users are using `dateFormat` and `excludes` to exclude entire years, since 10k days is 27 years, and anything above that starts to have noticable lag.
…elation stroke - Add EM theme variables to all built-in themes (dark, default, forest, neutral) so dark mode and other themes render with appropriate colors instead of always falling back to light-theme defaults. - Apply wrapLabel() to plain text before HTML assembly to prevent splitting inside HTML tags. Also remove redundant newline replacement in data block path since wrapLabel now handles line breaking on plain text. - Read relation stroke color from themeVariables.emRelationStroke in renderer instead of using hardcoded '#000' from db.ts. - Add emRelationStroke variable to all theme files including theme-base.
* master: (24 commits) Version Packages (#7561) Release candidate 11.14.0 (#7526) chore: Editor Picker V2 (#7497) Setting the link to Get started to the correct on Version Packages (#7466) fix: use correct package name for elk dummy commit Fix: ER diagram edge label positioning (#7453) chore: Update coupon fix(gantt): restore readable outside-text for done tasks in dark mode (#7456) fix(elk): scope rounded edge curve to ELK layout only (#7454) fix: plausible build chore: Update plausible chore: Update release version in docs chore: Track editor picker selection fix: update broken docsy link and exclude bot-blocked domains from link checker chore: replace MERMAID_RELEASE_VERSION placeholders with current version fix: correct package name in changeset slow-lemons-know Updated Hero text Version Packages ... # Conflicts: # .changeset/weak-tools-pay.md # docs/syntax/architecture.md # docs/syntax/timeline.md # docs/syntax/treeView.md # docs/syntax/wardley.md # docs/syntax/xyChart.md # packages/examples/CHANGELOG.md # packages/examples/package.json # packages/mermaid/CHANGELOG.md # packages/mermaid/package.json # packages/mermaid/src/diagrams/git/gitGraphRenderer.ts # packages/mermaid/src/docs/.vitepress/components/EditorSelectionModal.vue # packages/mermaid/src/docs/syntax/architecture.md # packages/mermaid/src/docs/syntax/timeline.md # packages/mermaid/src/docs/syntax/treeView.md # packages/mermaid/src/docs/syntax/wardley.md # packages/mermaid/src/docs/syntax/xyChart.md # packages/mermaid/src/rendering-util/rendering-elements/shapes/requirementBox.ts # packages/parser/CHANGELOG.md # packages/parser/package.json # packages/tiny/CHANGELOG.md # packages/tiny/package.json
…rability chore(deps): update dependency dompurify to v3.3.2 [security]
…igest chore(deps): update autofix-ci/action digest to 7a166d7
chore(deps): update dependency ajv to v8.18.0 [security]
If we don't have the `id-token: write` permission, there's no way we can accidentally write the NPM! But we still need `packages: write` to write to GitHub Packages.
Make sure that we use a preview tag for previews
Right now, since we're using `npm publish` instead of `pnpm publish`, the `^workspace:` specifier in our `package.json` file won't work. We're also not publishing a `@mermaid-js/parser` package. Instead, we can use `pnpm pack` to create a `.tgz` that `npm publish` can upload. We can also use `bundledDependencies` to include the `@mermaid-js/parser` package, in case the latest preview version of mermaid requires new changes to that package.
chore: fix bad merge commit for v11.14.0
…v11.15.0-release docs: improve `.changeset`s for v11.15.0 release on-behalf-of: @Mermaid-Chart <hello@mermaidchart.com>
fix: prevent unbalanced CSS in `classDef`s
fix: create CSS styles using the CSSOM
fix: block stylis scope escape
…otain-in-parser fix(parser): bundle `langium` and `chevrotain` inside `@mermaid-js/parser`
…tion ci: fix `release-preview-publish.yml` action on-behalf-of: @Mermaid-Chart <hello@mermaidchart.com>
The `wardleyRenderer` file never uses `.html()` or `.innerHTML` to set items within the HTML. Instead, it only ever uses D3 Selection's `.text`, which works `textContent`. This makes it immune to XSS attacks. When we over-sanitize this text, the diagram will show `<` instead of `<` in labels.
…-escapes-in-wardley fix(wardley): fix unnecessary sanitization of text
fedf70c (fix(class): Self-referential class multiplicity labels rendered multiple times, 2026-04-04) changed how `endLabel`s were rendered, by preventing them from being rendered within their `endEdgeLabelLeft` or `endLabelRight` elements, when they existed. Although when looking at the code, this seems correct (as otherwise `inner` is not used), this actually causes the labels to render on top of the edges, which makes the class diagrams look worse. This commit reverts that change, to avoid any visaul regression differences. Fixes: fedf70c
As the nested namespace PR might change rendering behaviour for existing class diagrams that use dots in their namespaces, I've updated the changeset to explain how you can disable this feature by using `class.hierarchicalNamespaces`.
…hanges fix: revert endEdgeLabelLeft/endEdgeLabelRight change
🦋 Changeset detectedLatest commit: d37c0db The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
|
The latest updates on your projects. Learn more about Argos notifications ↗︎
|
aloisklink
approved these changes
May 11, 2026
aloisklink
left a comment
aloisklink
left a comment
Member
There was a problem hiding this comment.
Looks good to me!
The new issue with CVE-2026-44728 doesn't look like it applies to us, since we only compile code that we trust (and I'm pretty sure we don't use SystemJS anywhere anyway), so I think we can wait for a @renovatebot PR in develop to fix it.
Merged
nschloe
pushed a commit
to live-clones/forgejo
that referenced
this pull request
May 12, 2026
…531) This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [mermaid](https://github.com/mermaid-js/mermaid) | [`11.13.0` → `11.15.0`](https://renovatebot.com/diffs/npm/mermaid/11.13.0/11.15.0) |  |  | --- ### Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS [CVE-2026-41150](https://nvd.nist.gov/vuln/detail/CVE-2026-41150) / [GHSA-6m6c-36f7-fhxh](GHSA-6m6c-36f7-fhxh) <details> <summary>More information</summary> #### Details ##### Impact Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the [`excludes` attribute](https://mermaid.js.org/syntax/gantt.html?#excludes) to exclude all dates. Example: ``` gantt excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday DoS :2025-01-01, 1d ``` `mermaid.parse` is unaffected, unless you then call the `ganttDb.getTasks()` (which is called when rendering a diagram). ##### Patches This has been patched in: - [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [faafb5d49106dd32c367f3882505f2dd625aa30e](mermaid-js/mermaid@faafb5d)) - [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a59ea56174712ee5430dfd5bc877cb5151f501a6](mermaid-js/mermaid@a59ea56)) ##### Workarounds There are no workarounds available without updating to a newer version of mermaid. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh) - [https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6](https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6) - [https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e](https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e) - [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-6m6c-36f7-fhxh) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid: Improper sanitization of configuration leads to CSS injection [CVE-2026-41159](https://nvd.nist.gov/vuln/detail/CVE-2026-41159) / [GHSA-87f9-hvmw-gh4p](GHSA-87f9-hvmw-gh4p) <details> <summary>More information</summary> #### Details ##### Impact Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the `fontFamily`, `themeCSS`, and `altFontFamily` configuration options. Live demo: [mermaid.live](https://mermaid.live/edit#pako:eNpNjktLxDAUhf9KvFBR6JS-60QQfODKlUvJ5k6TtsEmKTHFGUP-u-mI6Nmdy3fOPR56wwVQSBIvtXSUeAaD0e4ZlZxPDChhcLxFfwiEauOuLq_9Afv30ZpVczpaITS5kGox1qF2gfSeBwYhJAnThAyz-ewntI68vG5-0z3Z7e7IA9OQwmglB-rsKlJQwircLPgNZeAmocTPAi4GXGfHgOkQYwvqN2PUbzJuGSegA84f0a0LRyeeJI4W_xChubCPcbQD2pwbgHo4Aq2aKmvbqq3zoiu7pizqFE6RybN9VFfFY1HWXRVS-Dr_zLObrt7_V_gGGXZlGg) Example code: ``` %%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%% flowchart LR A --> B ``` The injected CSS exploits stylis's `&` (scope reference) handling. `:not(&)` escapes the `#mermaid-xxx` automatic scoping, applying styles to all page elements. Global at-rules (`@font-face`, `@keyframes`, `@counter-style`) are also injectable as stylis hoists them to top level. This allows page defacement and DOM attribute exfiltration via CSS `:has()` selectors. ##### Patches - [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [64769738d5b59211e1decb471ffbaca8afec51aa](mermaid-js/mermaid@6476973)) - [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [a9d9f0d8eb790349121508688cd338253fd80d76](mermaid-js/mermaid@a9d9f0d)) ##### Workarounds If you can't upgrade mermaid, you can set the [`secure`](https://mermaid.js.org/config/schema-docs/config.html#secure) config value in the mermaid config to avoid allowing diagrams to modify `fontFamily`, `themeCSS`, `altFontFamily`, and `themeVariables`. Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will also prevent this. ##### Credits Reported by @​zsxsoft on behalf of @​KeenSecurityLab #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p) - [https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa](https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa) - [https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76](https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76) - [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-87f9-hvmw-gh4p) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection [CVE-2026-41149](https://nvd.nist.gov/vuln/detail/CVE-2026-41149) / [GHSA-ghcm-xqfw-q4vr](GHSA-ghcm-xqfw-q4vr) <details> <summary>More information</summary> #### Details ##### Impact Under the default configuration, Mermaid state diagram's `classDef` allow DOM injection that escapes the SVG, although `<script>` tags are removed, preventing XSS. ##### Proof-of-concept ``` stateDiagram-v2 classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b [*] --> A:::xss ``` ##### Patches - [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [37ff937f1da2e19f882fd1db01235db4d01f4056](mermaid-js/mermaid@37ff937)) - [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](mermaid-js/mermaid@4e2d512)) ##### Workarounds If you can not update to a patched version, setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`. ##### Credits Thanks to @​zsxsoft from @​KeenSecurityLab for reporting this vulnerability. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr) - [https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056](https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056) - [https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3](https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3) - [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-ghcm-xqfw-q4vr) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection [CVE-2026-41148](https://nvd.nist.gov/vuln/detail/CVE-2026-41148) / [GHSA-xcj9-5m2h-648r](GHSA-xcj9-5m2h-648r) <details> <summary>More information</summary> #### Details ##### Details The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures `classDef` values with an unrestricted regex: ```jison // packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83 <CLASSDEFID>[^\n]* { this.popState(); return 'CLASSDEF_STYLEOPTS' } ``` The value passes unsanitized through `addStyleClass()` -> `createCssStyles()` -> `style.innerHTML` (mermaidAPI.ts:418). A `}` in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page. ##### PoC ``` stateDiagram-v2 classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")} ``` Live demo: <https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU> ##### Patches This has been patched in: - [v11.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) (see [e9b0f34d8d82a6260077764ee45e1d7d90957a0f](mermaid-js/mermaid@e9b0f34)) - [v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) (see [8fead23c59166b7bab6a39eac81acebee2859102](mermaid-js/mermaid@8fead23)) ##### Workarounds Setting [`"securityLevel": "sandbox"`](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) will prevent this, by rendering the mermaid diagram in a sandboxed `<iframe>`. ##### Impact Enables page defacement, user tracking via `url()` callbacks, and DOM attribute exfiltration via CSS `:has()` selectors. #### Severity - CVSS Score: 5.3 / 10 (Medium) - Vector String: `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L` #### References - [https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r) - [https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102](https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102) - [https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f](https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f) - [https://github.com/mermaid-js/mermaid](https://github.com/mermaid-js/mermaid) - [https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) - [https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6](https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6) - [https://mermaid.js.org/config/schema-docs/config.html#securitylevel](https://mermaid.js.org/config/schema-docs/config.html#securitylevel) This data is provided by [OSV](https://osv.dev/vulnerability/GHSA-xcj9-5m2h-648r) and the [GitHub Advisory Database](https://github.com/github/advisory-database) ([CC-BY 4.0](https://github.com/github/advisory-database/blob/main/LICENSE.md)). </details> --- ### Release Notes <details> <summary>mermaid-js/mermaid (mermaid)</summary> ### [`v11.15.0`](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0) [Compare Source](https://github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0) ##### Minor Changes - [#​7174](mermaid-js/mermaid#7174) [`0aca217`](mermaid-js/mermaid@0aca217) Thanks [@​milesspencer35](https://github.com/milesspencer35)! - feat(sequence): Add support for decimal start and increment values in the `autonumber` directive - [#​7512](mermaid-js/mermaid#7512) [`8e17492`](mermaid-js/mermaid@8e17492) Thanks [@​aruncveli](https://github.com/aruncveli)! - feat(flowchart): add datastore shape In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with `A@{ shape: datastore, label: "Datastore" }`. - [#​6440](mermaid-js/mermaid#6440) [`9ad8dde`](mermaid-js/mermaid@9ad8dde) Thanks [@​yordis](https://github.com/yordis), [@​lgazo](https://github.com/lgazo)! - feat: add Event Modeling diagram - [#​7707](mermaid-js/mermaid#7707) [`27db774`](mermaid-js/mermaid@27db774) Thanks [@​txmxthy](https://github.com/txmxthy)! - feat(architecture): expose four fcose layout knobs for `architecture-beta` diagrams (`nodeSeparation`, `idealEdgeLengthMultiplier`, `edgeElasticity`, `numIter`) so authors can tune layout density and spread overlapping siblings without changing diagram source - [#​7604](mermaid-js/mermaid#7604) [`bf9502f`](mermaid-js/mermaid@bf9502f) Thanks [@​M-a-c](https://github.com/M-a-c)! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting If you have namespaces in class diagrams that use `.`s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set `class.hierarchicalNamespaces=false` in your mermaid config: ```yaml config: class: hierarchicalNamespaces: false ``` - [#​7272](mermaid-js/mermaid#7272) [`88cdd3d`](mermaid-js/mermaid@88cdd3d) Thanks [@​xinbenlv](https://github.com/xinbenlv)! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors ##### Patch Changes - [#​7737](mermaid-js/mermaid#7737) [`e9b0f34`](mermaid-js/mermaid@e9b0f34) Thanks [@​ashishjain0512](https://github.com/ashishjain0512)! - fix: prevent unbalanced CSS styles in classDefs - [#​7737](mermaid-js/mermaid#7737) [`37ff937`](mermaid-js/mermaid@37ff937) Thanks [@​ashishjain0512](https://github.com/ashishjain0512)! - fix: create CSS styles using the CSSOM This removes some invalid CSS and normalizes some CSS formatting. - [#​7508](mermaid-js/mermaid#7508) [`bfe60cc`](mermaid-js/mermaid@bfe60cc) Thanks [@​biiab](https://github.com/biiab)! - fix(stateDiagram): `end note` now only closes a note when used on a new line - [#​7737](mermaid-js/mermaid#7737) [`faafb5d`](mermaid-js/mermaid@faafb5d) Thanks [@​ashishjain0512](https://github.com/ashishjain0512)! - fix(gantt): add iteration limit for `excludes` field - [#​7737](mermaid-js/mermaid#7737) [`65f8be2`](mermaid-js/mermaid@65f8be2) Thanks [@​ashishjain0512](https://github.com/ashishjain0512)! - fix: disallow some CSS at-rules in custom CSS - [#​7726](mermaid-js/mermaid#7726) [`1502f32`](mermaid-js/mermaid@1502f32) Thanks [@​aloisklink](https://github.com/aloisklink)! - fix(wardley): fix unnecessary sanitization of text - [#​7578](mermaid-js/mermaid#7578) [`1f98db8`](mermaid-js/mermaid@1f98db8) Thanks [@​Gaston202](https://github.com/Gaston202)! - fix(class): self-referential class multiplicity labels no longer rendered multiple times Fixes [#​7560](mermaid-js/mermaid#7560). Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions. - [#​7592](mermaid-js/mermaid#7592) [`2343e38`](mermaid-js/mermaid@2343e38) Thanks [@​knsv-bot](https://github.com/knsv-bot)! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams - [#​7589](mermaid-js/mermaid#7589) [`7fb9509`](mermaid-js/mermaid@7fb9509) Thanks [@​NYCU-Chung](https://github.com/NYCU-Chung)! - fix(block): prevent column widths from shrinking when mixing different column spans - [#​7632](mermaid-js/mermaid#7632) [`3f9e0f1`](mermaid-js/mermaid@3f9e0f1) Thanks [@​ekiauhce](https://github.com/ekiauhce)! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams - [#​7642](mermaid-js/mermaid#7642) [`7a8fb85`](mermaid-js/mermaid@7a8fb85) Thanks [@​tractorjuice](https://github.com/tractorjuice)! - fix(wardley): allow hyphens in unquoted component names Multi-word names containing hyphens — e.g. `real-time processing`, `end-user`, `on-call engineer` — now parse without quoting, bringing the grammar in line with the OnlineWardleyMaps (OWM) convention. `A->B` (no-space arrow) still tokenises correctly. - [#​7523](mermaid-js/mermaid#7523) [`5144ed4`](mermaid-js/mermaid@5144ed4) Thanks [@​darshanr0107](https://github.com/darshanr0107)! - fix(block): Arrow blocks in block-beta diagrams not spanning the specified number of columns when using `:n` syntax. - [#​7262](mermaid-js/mermaid#7262) [`13d9bfa`](mermaid-js/mermaid@13d9bfa) Thanks [@​darshanr0107](https://github.com/darshanr0107)! - fix(block): Ensure block diagram hexagon blocks respect column spanning syntax - [#​7684](mermaid-js/mermaid#7684) [`e14bb88`](mermaid-js/mermaid@e14bb88) Thanks [@​aloisklink](https://github.com/aloisklink)! - fix: loosen `uuid` dependency range to allow v14 Mermaid does not use any of the vulnerable code in CVE-2026-41907, but this allows users to silence any `npm audit` alerts on it. - [#​7633](mermaid-js/mermaid#7633) [`9217c0d`](mermaid-js/mermaid@9217c0d) Thanks [@​Felix-Garci](https://github.com/Felix-Garci)! - fix(block): add support for all arrow types in block diagrams - [#​7587](mermaid-js/mermaid#7587) [`5e7eb62`](mermaid-js/mermaid@5e7eb62) Thanks [@​MaddyGuthridge](https://github.com/MaddyGuthridge)! - chore: drop lodash-es in favour of es-toolkit - [#​7693](mermaid-js/mermaid#7693) [`afaf306`](mermaid-js/mermaid@afaf306) Thanks [@​dull-bird](https://github.com/dull-bird)! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Previously the lexer only matched ASCII `[A-Za-z]+` for text tokens, even though the grammar referenced `UNICODE_TEXT`. Bare Chinese, Japanese, Korean, emoji, and accented Latin characters in labels caused a parse error. Added a `[^\x00-\x7F]+` lexer rule to emit `UNICODE_TEXT` and included it in the `alphaNumToken` grammar rule. Fixes [#​7120](mermaid-js/mermaid#7120). - [#​7737](mermaid-js/mermaid#7737) [`4755553`](mermaid-js/mermaid@4755553) Thanks [@​ashishjain0512](https://github.com/ashishjain0512)! - fix: improve D3 types for mermaidAPI funcs - [#​7737](mermaid-js/mermaid#7737) [`6476973`](mermaid-js/mermaid@6476973) Thanks [@​ashishjain0512](https://github.com/ashishjain0512)! - fix: handle `&` when namespacing CSS rules - [#​7520](mermaid-js/mermaid#7520) [`8c1a0c1`](mermaid-js/mermaid@8c1a0c1) Thanks [@​RodrigojndSantos](https://github.com/RodrigojndSantos)! - fix(stateDiagram): comments starting with one `%` are no longer treated as comments Switch to using two `%%` if you want to write a comment. - Updated dependencies \[[`7a8fb85`](mermaid-js/mermaid@7a8fb85), [`675a64c`](mermaid-js/mermaid@675a64c)]: - [@​mermaid-js/parser](https://github.com/mermaid-js/parser)@​1.1.1 ### [`v11.14.0`](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.14.0) [Compare Source](https://github.com/mermaid-js/mermaid/compare/mermaid@11.13.0...mermaid@11.14.0) Thanks to our awesome mermaid community that contributed to this release: [@​ashishjain0512](https://github.com/ashishjain0512), [@​tractorjuice](https://github.com/tractorjuice), [@​autofix-ci\[bot\]](https://github.com/autofix-ci%5Bbot%5D), [@​aloisklink](https://github.com/aloisklink), [@​knsv](https://github.com/knsv), [@​kibanana](https://github.com/kibanana), [@​chandershekhar22](https://github.com/chandershekhar22), [@​khalil](https://github.com/khalil), [@​ytatsuno](https://github.com/ytatsuno), [@​sidharthv96](https://github.com/sidharthv96), [@​github-actions\[bot\]](https://github.com/github-actions%5Bbot%5D), [@​dripcoding](https://github.com/dripcoding), [@​knsv-bot](https://github.com/knsv-bot), [@​jeroensmink98](https://github.com/jeroensmink98), [@​Alex9583](https://github.com/Alex9583), [@​GhassenS](https://github.com/GhassenS), [@​omkarht](https://github.com/omkarht), [@​darshanr0107](https://github.com/darshanr0107), [@​leentaylor](https://github.com/leentaylor), [@​lee-treehouse](https://github.com/lee-treehouse), [@​veeceey](https://github.com/veeceey), [@​turntrout](https://github.com/turntrout), [@​Mermaid-Chart](https://github.com/Mermaid-Chart), [@​BambioGaming](https://github.com/BambioGaming), Claude ### Releases #### [@​mermaid-js/examples](https://github.com/mermaid-js/examples)@​1.2.0 ##### Minor Changes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram #### mermaid\@​11.14.0 ##### Minor Changes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Add Wardley Maps diagram type (beta) Adds Wardley Maps as a new diagram type to Mermaid (available as `wardley-beta`). Wardley Maps are visual representations of business strategy that help map value chains and component evolution. Features: - Component positioning with \[visibility, evolution] coordinates (OWM format) - Anchors for users/customers - Multiple link types: dependencies, flows, labeled links - Evolution arrows and trend indicators - Custom evolution stages with optional dual labels - Custom stage widths using [@​boundary](https://github.com/boundary) notation - Pipeline components with visibility inheritance - Annotations, notes, and visual elements - Source strategy markers: build, buy, outsource, market - Inertia indicators - Theme integration Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation. - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for state diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add `randomize` config option for architecture diagrams, defaulting to `false` for deterministic layout - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: Add option to change timeline direction - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like `#arrowhead` should use attribute-ending selectors like `[id$="-arrowhead"]` instead. - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for ER diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for requirement diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add theme support for data label colour in xy chart - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for mindmap diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look for mermaid flowchart diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look and themes for class diagram - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add showDataLabelOutsideBar option for xy chart - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look and themes for gitGraph diagram - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram ##### Patch Changes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add link to ishikawa diagram on mermaid.js.org - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - docs: document valid duration token formats in gantt.md - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: ER diagram parsing when using "1" as entity identifier on right side The parser was incorrectly tokenizing the second "1" in patterns like `a many to 1 1:` because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern `"1"(?=\s+[0-9])` to correctly identify the cardinality alias before a numeric entity name. Fixes [#​7472](mermaid-js/mermaid#7472) - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: scope cytoscape label style mapping to edges with labels to prevent console warnings - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: support inline annotation syntax in class diagrams (class Shape <<interface>>) - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Align branch label background with text for multi-line labels in LR GitGraph layout - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: preserve cause hierarchy when ishikawa effect is indented more than causes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Prevent long pie chart titles from being clipped by expanding the viewBox - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: warn when `style` statement targets a non-existent node in flowcharts - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: group state diagram SVG children under single root <g> element - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Allow :::className syntax inside composite state blocks - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) Thanks [@​aloisklink](https://github.com/aloisklink), [@​BambioGaming](https://github.com/BambioGaming)! - fix: prevent escaping `<` and `&` when `htmlLabels: false` - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: treemap title and labels use theme-aware colors for dark backgrounds - Updated dependencies \[[`efe218a`](mermaid-js/mermaid@efe218a)]: - [@​mermaid-js/parser](https://github.com/mermaid-js/parser)@​1.1.0 #### [@​mermaid-js/parser](https://github.com/mermaid-js/parser)@​1.1.0 ##### Minor Changes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram #### [@​mermaid-js/tiny](https://github.com/mermaid-js/tiny)@​11.14.0 ##### Minor Changes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Add Wardley Maps diagram type (beta) Adds Wardley Maps as a new diagram type to Mermaid (available as `wardley-beta`). Wardley Maps are visual representations of business strategy that help map value chains and component evolution. Features: - Component positioning with \[visibility, evolution] coordinates (OWM format) - Anchors for users/customers - Multiple link types: dependencies, flows, labeled links - Evolution arrows and trend indicators - Custom evolution stages with optional dual labels - Custom stage widths using [@​boundary](https://github.com/boundary) notation - Pipeline components with visibility inheritance - Annotations, notes, and visual elements - Source strategy markers: build, buy, outsource, market - Inertia indicators - Theme integration Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation. - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for state diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add `randomize` config option for architecture diagrams, defaulting to `false` for deterministic layout - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: Add option to change timeline direction - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like `#arrowhead` should use attribute-ending selectors like `[id$="-arrowhead"]` instead. - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for ER diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for requirement diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add theme support for data label colour in xy chart - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look styling for mindmap diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look for mermaid flowchart diagrams - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look and themes for class diagram - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: add showDataLabelOutsideBar option for xy chart - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - feat: implement neo look and themes for gitGraph diagram - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add new TreeView diagram ##### Patch Changes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - add link to ishikawa diagram on mermaid.js.org - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - docs: document valid duration token formats in gantt.md - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: ER diagram parsing when using "1" as entity identifier on right side The parser was incorrectly tokenizing the second "1" in patterns like `a many to 1 1:` because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern `"1"(?=\s+[0-9])` to correctly identify the cardinality alias before a numeric entity name. Fixes [#​7472](mermaid-js/mermaid#7472) - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: scope cytoscape label style mapping to edges with labels to prevent console warnings - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: support inline annotation syntax in class diagrams (class Shape <<interface>>) - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Align branch label background with text for multi-line labels in LR GitGraph layout - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: preserve cause hierarchy when ishikawa effect is indented more than causes - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Prevent long pie chart titles from being clipped by expanding the viewBox - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: warn when `style` statement targets a non-existent node in flowcharts - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: group state diagram SVG children under single root <g> element - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: Allow :::className syntax inside composite state blocks - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) Thanks [@​aloisklink](https://github.com/aloisklink), [@​BambioGaming](https://github.com/BambioGaming)! - fix: prevent escaping `<` and `&` when `htmlLabels: false` - [#​7526](mermaid-js/mermaid#7526) [`efe218a`](mermaid-js/mermaid@efe218a) - fix: treemap title and labels use theme-aware colors for dark backgrounds - Updated dependencies \[[`efe218a`](mermaid-js/mermaid@efe218a)]: - [@​mermaid-js/parser](https://github.com/mermaid-js/parser)@​1.1.0 </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - "" - Automerge - Between 12:00 AM and 03:59 AM (`* 0-3 * * *`) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ1cGRhdGVkSW5WZXIiOiI0My4xNzAuMjAiLCJ0YXJnZXRCcmFuY2giOiJ2MTUuMC9mb3JnZWpvIiwibGFiZWxzIjpbImRlcGVuZGVuY3ktdXBncmFkZSIsInRlc3Qvbm90LW5lZWRlZCJdfQ==--> Reviewed-on: https://codeberg.org/forgejo/forgejo/pulls/12531 Reviewed-by: Mathieu Fenniak <mfenniak@noreply.codeberg.org>
github-actions Bot
added a commit
to zhongmiao-org/mermaid-markdown-bridge
that referenced
this pull request
May 12, 2026
Upstream release: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 Release notes: ### Minor Changes - [#7174](mermaid-js/mermaid#7174) [`0aca217`](mermaid-js/mermaid@0aca217) Thanks [@milesspencer35](https://github.com/milesspencer35)! - feat(sequence): Add support for decimal start and increment values in the `autonumber` directive - [#7512](mermaid-js/mermaid#7512) [`8e17492`](mermaid-js/mermaid@8e17492) Thanks [@aruncveli](https://github.com/aruncveli)! - feat(flowchart): add datastore shape In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with `A@{ shape: datastore, label: "Datastore" }`. - [#6440](mermaid-js/mermaid#6440) [`9ad8dde`](mermaid-js/mermaid@9ad8dde) Thanks [@yordis](https://github.com/yordis), [@lgazo](https://github.com/lgazo)! - feat: add Event Modeling diagram - [#7707](mermaid-js/mermaid#7707) [`27db774`](mermaid-js/mermaid@27db774) Thanks [@txmxthy](https://github.com/txmxthy)! - feat(architecture): expose four fcose layout knobs for `architecture-beta` diagrams (`nodeSeparation`, `idealEdgeLengthMultiplier`, `edgeElasticity`, `numIter`) so authors can tune layout density and spread overlapping siblings without changing diagram source - [#7604](mermaid-js/mermaid#7604) [`bf9502f`](mermaid-js/mermaid@bf9502f) Thanks [@M-a-c](https://github.com/M-a-c)! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting If you have namespaces in class diagrams that use `.`s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set `class.hierarchicalNamespaces=false` in your mermaid config: ```yaml config: class: hierarchicalNamespaces: false ``` - [#7272](mermaid-js/mermaid#7272) [`88cdd3d`](mermaid-js/mermaid@88cdd3d) Thanks [@xinbenlv](https://github.com/xinbenlv)! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors ### Patch Changes - [#7737](mermaid-js/mermaid#7737) [`e9b0f34`](mermaid-js/mermaid@e9b0f34) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: prevent unbalanced CSS styles in classDefs - [#7737](mermaid-js/mermaid#7737) [`37ff937`](mermaid-js/mermaid@37ff937) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: create CSS styles using the CSSOM This removes some invalid CSS and normalizes some CSS formatting. - [#7508](mermaid-js/mermaid#7508) [`bfe60cc`](mermaid-js/mermaid@bfe60cc) Thanks [@biiab](https://github.com/biiab)! - fix(stateDiagram): `end note` now only closes a note when used on a new line - [#7737](mermaid-js/mermaid#7737) [`faafb5d`](mermaid-js/mermaid@faafb5d) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix(gantt): add iteration limit for `excludes` field - [#7737](mermaid-js/mermaid#7737) [`65f8be2`](mermaid-js/mermaid@65f8be2) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: disallow some CSS at-rules in custom CSS - [#7726](mermaid-js/mermaid#7726) [`1502f32`](mermaid-js/mermaid@1502f32) Thanks [@aloisklink](https://github.com/aloisklink)! - fix(wardley): fix unnecessary sanitization of text - [#7578](mermaid-js/mermaid#7578) [`1f98db8`](mermaid-js/mermaid@1f98db8) Thanks [@Gaston202](https://github.com/Gaston202)! - fix(class): self-referential class multiplicity labels no longer rendered multiple times Fixes #7560. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions. - [#7592](mermaid-js/mermaid#7592) [`2343e38`](mermaid-js/mermaid@2343e38) Thanks [@knsv-bot](https://github.com/knsv-bot)! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams - [#7589](mermaid-js/mermaid#7589) [`7fb9509`](mermaid-js/mermaid@7fb9509) Thanks [@NYCU-Chung](https://github.com/NYCU-Chung)! - fix(block): prevent column widths from shrinking when mixing different column spans - [#7632](mermaid-js/mermaid#7632) [`3f9e0f1`](mermaid-js/mermaid@3f9e0f1) Thanks [@ekiauhce](https://github.com/ekiauhce)! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams - [#7642](mermaid-js/mermaid#7642) [`7a8fb85`](mermaid-js/mermaid@7a8fb85) Thanks [@tractorjuice](https://github.com/tractorjuice)! - fix(wardley): allow hyphens in unquoted component names Multi-word names containing hyphens — e.g. `real-time processing`, `end-user`, `on-call engineer` — now parse without quoting, bringing the grammar in line with the OnlineWardleyMaps (OWM) convention. `A->B` (no-space arrow) still tokenises correctly. - [#7523](mermaid-js/mermaid#7523) [`5144ed4`](mermaid-js/mermaid@5144ed4) Thanks [@darshanr0107](https://github.com/darshanr0107)! - fix(block): Arrow blocks in block-beta diagrams not spanning the specified number of columns when using `:n` syntax. - [#7262](mermaid-js/mermaid#7262) [`13d9bfa`](mermaid-js/mermaid@13d9bfa) Thanks [@darshanr0107](https://github.com/darshanr0107)! - fix(block): Ensure block diagram hexagon blocks respect column spanning syntax - [#7684](mermaid-js/mermaid#7684) [`e14bb88`](mermaid-js/mermaid@e14bb88) Thanks [@aloisklink](https://github.com/aloisklink)! - fix: loosen `uuid` dependency range to allow v14 Mermaid does not use any of the vulnerable code in CVE-2026-41907, but this allows users to silence any `npm audit` alerts on it. - [#7633](mermaid-js/mermaid#7633) [`9217c0d`](mermaid-js/mermaid@9217c0d) Thanks [@Felix-Garci](https://github.com/Felix-Garci)! - fix(block): add support for all arrow types in block diagrams - [#7587](mermaid-js/mermaid#7587) [`5e7eb62`](mermaid-js/mermaid@5e7eb62) Thanks [@MaddyGuthridge](https://github.com/MaddyGuthridge)! - chore: drop lodash-es in favour of es-toolkit - [#7693](mermaid-js/mermaid#7693) [`afaf306`](mermaid-js/mermaid@afaf306) Thanks [@dull-bird](https://github.com/dull-bird)! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Previously the lexer only matched ASCII `[A-Za-z]+` for text tokens, even though the grammar referenced `UNICODE_TEXT`. Bare Chinese, Japanese, Korean, emoji, and accented Latin characters in labels caused a parse error. Added a `[^\x00-\x7F]+` lexer rule to emit `UNICODE_TEXT` and included it in the `alphaNumToken` grammar rule. Fixes #7120. - [#7737](mermaid-js/mermaid#7737) [`4755553`](mermaid-js/mermaid@4755553) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: improve D3 types for mermaidAPI funcs - [#7737](mermaid-js/mermaid#7737) [`6476973`](mermaid-js/mermaid@6476973) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: handle `&` when namespacing CSS rules - [#7520](mermaid-js/mermaid#7520) [`8c1a0c1`](mermaid-js/mermaid@8c1a0c1) Thanks [@RodrigojndSantos](https://github.com/RodrigojndSantos)! - fix(stateDiagram): comments starting with one `%` are no longer treated as comments Switch to using two `%%` if you want to write a comment. - Updated dependencies \[[`7a8fb85`](mermaid-js/mermaid@7a8fb85), [`675a64c`](mermaid-js/mermaid@675a64c)]: - @mermaid-js/parser@1.1.1 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: give me a 98K <240642031+inhuman-0@users.noreply.github.com>
ark-65
added a commit
to zhongmiao-org/mermaid-markdown-bridge
that referenced
this pull request
May 12, 2026
Upstream release: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0 Release notes: ### Minor Changes - [#7174](mermaid-js/mermaid#7174) [`0aca217`](mermaid-js/mermaid@0aca217) Thanks [@milesspencer35](https://github.com/milesspencer35)! - feat(sequence): Add support for decimal start and increment values in the `autonumber` directive - [#7512](mermaid-js/mermaid#7512) [`8e17492`](mermaid-js/mermaid@8e17492) Thanks [@aruncveli](https://github.com/aruncveli)! - feat(flowchart): add datastore shape In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with `A@{ shape: datastore, label: "Datastore" }`. - [#6440](mermaid-js/mermaid#6440) [`9ad8dde`](mermaid-js/mermaid@9ad8dde) Thanks [@yordis](https://github.com/yordis), [@lgazo](https://github.com/lgazo)! - feat: add Event Modeling diagram - [#7707](mermaid-js/mermaid#7707) [`27db774`](mermaid-js/mermaid@27db774) Thanks [@txmxthy](https://github.com/txmxthy)! - feat(architecture): expose four fcose layout knobs for `architecture-beta` diagrams (`nodeSeparation`, `idealEdgeLengthMultiplier`, `edgeElasticity`, `numIter`) so authors can tune layout density and spread overlapping siblings without changing diagram source - [#7604](mermaid-js/mermaid#7604) [`bf9502f`](mermaid-js/mermaid@bf9502f) Thanks [@M-a-c](https://github.com/M-a-c)! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting If you have namespaces in class diagrams that use `.`s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set `class.hierarchicalNamespaces=false` in your mermaid config: ```yaml config: class: hierarchicalNamespaces: false ``` - [#7272](mermaid-js/mermaid#7272) [`88cdd3d`](mermaid-js/mermaid@88cdd3d) Thanks [@xinbenlv](https://github.com/xinbenlv)! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors ### Patch Changes - [#7737](mermaid-js/mermaid#7737) [`e9b0f34`](mermaid-js/mermaid@e9b0f34) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: prevent unbalanced CSS styles in classDefs - [#7737](mermaid-js/mermaid#7737) [`37ff937`](mermaid-js/mermaid@37ff937) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: create CSS styles using the CSSOM This removes some invalid CSS and normalizes some CSS formatting. - [#7508](mermaid-js/mermaid#7508) [`bfe60cc`](mermaid-js/mermaid@bfe60cc) Thanks [@biiab](https://github.com/biiab)! - fix(stateDiagram): `end note` now only closes a note when used on a new line - [#7737](mermaid-js/mermaid#7737) [`faafb5d`](mermaid-js/mermaid@faafb5d) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix(gantt): add iteration limit for `excludes` field - [#7737](mermaid-js/mermaid#7737) [`65f8be2`](mermaid-js/mermaid@65f8be2) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: disallow some CSS at-rules in custom CSS - [#7726](mermaid-js/mermaid#7726) [`1502f32`](mermaid-js/mermaid@1502f32) Thanks [@aloisklink](https://github.com/aloisklink)! - fix(wardley): fix unnecessary sanitization of text - [#7578](mermaid-js/mermaid#7578) [`1f98db8`](mermaid-js/mermaid@1f98db8) Thanks [@Gaston202](https://github.com/Gaston202)! - fix(class): self-referential class multiplicity labels no longer rendered multiple times Fixes #7560. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions. - [#7592](mermaid-js/mermaid#7592) [`2343e38`](mermaid-js/mermaid@2343e38) Thanks [@knsv-bot](https://github.com/knsv-bot)! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams - [#7589](mermaid-js/mermaid#7589) [`7fb9509`](mermaid-js/mermaid@7fb9509) Thanks [@NYCU-Chung](https://github.com/NYCU-Chung)! - fix(block): prevent column widths from shrinking when mixing different column spans - [#7632](mermaid-js/mermaid#7632) [`3f9e0f1`](mermaid-js/mermaid@3f9e0f1) Thanks [@ekiauhce](https://github.com/ekiauhce)! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams - [#7642](mermaid-js/mermaid#7642) [`7a8fb85`](mermaid-js/mermaid@7a8fb85) Thanks [@tractorjuice](https://github.com/tractorjuice)! - fix(wardley): allow hyphens in unquoted component names Multi-word names containing hyphens — e.g. `real-time processing`, `end-user`, `on-call engineer` — now parse without quoting, bringing the grammar in line with the OnlineWardleyMaps (OWM) convention. `A->B` (no-space arrow) still tokenises correctly. - [#7523](mermaid-js/mermaid#7523) [`5144ed4`](mermaid-js/mermaid@5144ed4) Thanks [@darshanr0107](https://github.com/darshanr0107)! - fix(block): Arrow blocks in block-beta diagrams not spanning the specified number of columns when using `:n` syntax. - [#7262](mermaid-js/mermaid#7262) [`13d9bfa`](mermaid-js/mermaid@13d9bfa) Thanks [@darshanr0107](https://github.com/darshanr0107)! - fix(block): Ensure block diagram hexagon blocks respect column spanning syntax - [#7684](mermaid-js/mermaid#7684) [`e14bb88`](mermaid-js/mermaid@e14bb88) Thanks [@aloisklink](https://github.com/aloisklink)! - fix: loosen `uuid` dependency range to allow v14 Mermaid does not use any of the vulnerable code in CVE-2026-41907, but this allows users to silence any `npm audit` alerts on it. - [#7633](mermaid-js/mermaid#7633) [`9217c0d`](mermaid-js/mermaid@9217c0d) Thanks [@Felix-Garci](https://github.com/Felix-Garci)! - fix(block): add support for all arrow types in block diagrams - [#7587](mermaid-js/mermaid#7587) [`5e7eb62`](mermaid-js/mermaid@5e7eb62) Thanks [@MaddyGuthridge](https://github.com/MaddyGuthridge)! - chore: drop lodash-es in favour of es-toolkit - [#7693](mermaid-js/mermaid#7693) [`afaf306`](mermaid-js/mermaid@afaf306) Thanks [@dull-bird](https://github.com/dull-bird)! - fix(quadrant-chart): allow CJK, emoji, Latin-1 accented characters, and other non-ASCII text in unquoted axis/quadrant/point labels. Previously the lexer only matched ASCII `[A-Za-z]+` for text tokens, even though the grammar referenced `UNICODE_TEXT`. Bare Chinese, Japanese, Korean, emoji, and accented Latin characters in labels caused a parse error. Added a `[^\x00-\x7F]+` lexer rule to emit `UNICODE_TEXT` and included it in the `alphaNumToken` grammar rule. Fixes #7120. - [#7737](mermaid-js/mermaid#7737) [`4755553`](mermaid-js/mermaid@4755553) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: improve D3 types for mermaidAPI funcs - [#7737](mermaid-js/mermaid#7737) [`6476973`](mermaid-js/mermaid@6476973) Thanks [@ashishjain0512](https://github.com/ashishjain0512)! - fix: handle `&` when namespacing CSS rules - [#7520](mermaid-js/mermaid#7520) [`8c1a0c1`](mermaid-js/mermaid@8c1a0c1) Thanks [@RodrigojndSantos](https://github.com/RodrigojndSantos)! - fix(stateDiagram): comments starting with one `%` are no longer treated as comments Switch to using two `%%` if you want to write a comment. - Updated dependencies \[[`7a8fb85`](mermaid-js/mermaid@7a8fb85), [`675a64c`](mermaid-js/mermaid@675a64c)]: - @mermaid-js/parser@1.1.1 Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: give me a 98K <240642031+inhuman-0@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📑 Summary
This pull request introduces several new features and important fixes across multiple diagram types in Mermaid, along with some improvements to CSS handling and layout configuration. Notably, it adds support for Event Modeling diagrams, enhances class and flowchart diagrams, and addresses various rendering and parsing issues. The most significant changes are summarized below:
New Features and Diagram Enhancements:
eventmodelingdiagrams (.build/jsonSchema.ts,.changeset/event-modeling-diagram.md). [1] [2].changeset/feat-nested-namespaces.md)..changeset/eager-cobras-slide.md).architecture-betadiagrams, allowing users to fine-tune layout density and sibling overlap (.changeset/feat-architecture-fcose-config.md).autonumberdirective for sequence diagrams (.changeset/dark-bats-build.md).Bug Fixes and Rendering Improvements:
.changeset/fix-7560-self-referential-multiplicity.md)..changeset/fix-sequence-messagealign-rtl-arrows.md,.changeset/fix-alt-else-label-box.md). [1] [2].changeset/fix-block-beta-width.md,.changeset/fruity-ghosts-watch.md). [1] [2]end noteonly closes a note when on a new line (.changeset/cold-snakes-attend.md).CSS and Parsing Improvements:
.changeset/curly-rules-flow.md,.changeset/cold-numbers-taste.md,.changeset/brave-rooms-rest.md). [1] [2] [3].changeset/fix-wardley-hyphenated-names.md,.changeset/few-loops-shake.md). [1] [2]Other Notable Fixes:
excludesfield in Gantt diagrams to prevent excessive computation (.changeset/common-parents-serve.md)..changeset/fix-mindmap-tidy-tree-root-edges.md)..changeset/fix-zenuml-svg-renderer.md).Resolves #
📏 Design Decisions
Describe the way your implementation works or what design decisions you made if applicable.
📋 Tasks
Make sure you
MERMAID_RELEASE_VERSIONis used for all new features.pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.