Repository navigation
Release Candidate 11.16.1 - #8022
Merged
Merged
Conversation
Currently, if you have a broken diagram when using `dev/example.html`, then refresh the page, the page breaks. Changing the `await render()` to happen after the event listeners are setup fixes this.
This gets us out of quirks mode and uses proper HTML mode.
Conflicts: - demos/dev/example.html (added the elk layout) - demos/index.html
This adds some improvements to `demos/dev/example.html` (e.g. error handling, showing errors, and timing info) that make it easier to test mermaid locally.
* fix(architecture): handle arbitrary prototype pollution
Update the `ArchitectureGroupAlignments` to use a
`Map<`${string}-${string},` instead of being a
`Record<string, Record<string,`. Not only does this make the code
simpler, but it also means we avoid arbritary prototype pollution
attacks.
Fixes: GHSA-3rrr-jr9j-h3q3
Fixes: cb0a470
* refactor(architecture): use `Map` for registeredIds
* fix(architecture): improve group ID handling
`__proto__`, `constructor`, `toString`, etc. can now be used as a group ID in
architecture diagrams.
* refactor(architecture): use Map for nodes in DB
* refactor(architecture): use Map for spatial maps
* refactor(architecture): use `Set` for visit record
* refactor(architecture): use Map for `adjList`
* refactor(architecture): use Map for elements storage
* refactor(architecture): use Map for alignments
* test(architecture): test for service ID sorting
The old code sorted services by their ID using object iteration order,
which would sort numeric keys before string keys.
Now they are sorted in insertion order, so you can change around the
order of `service` statements in your diagram.
* test(architecture): test for GHSA-3rrr-jr9j-h3q3
Add a modified test to confirm that the prototype pollution in
GHSA-3rrr-jr9j-h3q3 is no longer exploitable.
The current radar diagram renderer adds a very ugly gradient to radar diagrams, even if the number of ticks goes above 30. Because of that, I used 32 as the maximum number of ticks, as anything higher than that doesn't seem to be useable. Just in case people are using a higher number (e.g. accidentally), I've made this only a soft warning, and will continue rendering a radar diagram over the limit, just with 32 ticks instead. Fixes: GHSA-rhh3-jpg6-66xh
* fix(xyChart): fix incorrect spacing, added e2e-test Cherry-picked-from: 46fe731 * fix(xychart): support zero-width x-axis ranges Add support for an x-axis range that has zero-width, e.g. ``` xychart-beta x-axis 0 --> 0 line [1, 2] ``` This also fixes floating-point rounding issues for very large ranges. Fixes: GHSA-2v8p-3f2j-5mp7 --------- Co-authored-by: OG-NI <in.neu@online.de>
* refactor: remove unused `clobber` from `assignWithDepth` * docs: improve `assignWithDepth` documentation Fixes the formatting of the `assignWithDepth` function's TSDoc. * fix: refactor `assignWithDepth` This makes it prototype pollution resistant, and it also handles `null` values like `undefined`. Additionally, I've got rid of more of the `any` types, so it's slightly safer. Fixes: GHSA-c4c3-pg64-4m4v * deprecate: deprecate public `setConfig` function Deprecate the existing `mermaidAPI.setConfig()` function. Calling this function has no observable effect, as the next time a `render()` or `parse()` is called, the `currentConfig` is cleared. * docs: rewrite config function doc comments The function documentation comments in `config.ts` are still using the old pre-typedoc [`documentation`][1] strings. [1]: https://www.npmjs.com/package/documentation * refactor: stop exporting `updateCurrentConfig` This function is only ever exported for one unit test, but since it's exported from this file, it shows up in <https://mermaid.js.org/config/setup/config/README.html> unnecessarily, since it's not exposed anywhere as part of the public mermaid API. * test: test and doc assignWithDepth pollution fix
Stylis compiles `& ~ *` and `& + *` to `#svgId ~ *` / `#svgId + *`,
which select DOM siblings of the SVG element (aka outside of the SVG
boundary).
This commit changes the `addNamespace` middleware to detect when a
selector uses one of these, and namespaces it properly, e.g.
`#svgId ~ *` into `#svgId #svgId ~ *`.
I've also added support for handling the [column combinator `||`][1].
It's experimental, but there's no reason not to handle it.
For `& {`, I had to do some special handling. Technically, it's not
namespaced, but namespacing it with `& &` breaks, and replacing it with
`& > *` overwrites some SVG presentation attributes, so it breaks
existing diagrams. Instead, I've just added a quick check that allows it
if-and-only-if it only has `font-family`, `font-size`, or `fill` rules.
[1]: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Column_combinator
Reported-by: h3ri0s <rohitprasanth8@gmail.com>
See: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Next-sibling_combinator
See: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Subsequent-sibling_combinator
Fixes: 6476973
We used squash merges, so the original commit IDs no longer exist.
🦋 Changeset detectedLatest commit: eba7287 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## master #8022 +/- ##
==========================================
+ Coverage 64.25% 64.30% +0.05%
==========================================
Files 670 670
Lines 75010 75072 +62
Branches 11149 11171 +22
==========================================
+ Hits 48195 48273 +78
+ Misses 26815 26799 -16
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
|
The latest updates on your projects. Learn more about Argos notifications ↗︎
|
Merged
ark-65
added a commit
to zhongmiao-org/mermaid-markdown-bridge
that referenced
this pull request
Aug 5, 2026
Upstream release: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1 Release notes: ### Patch Changes - [#8022](mermaid-js/mermaid#8022) [`12d472c`](mermaid-js/mermaid@12d472c) Thanks [@aloisklink](https://github.com/aloisklink)! - fix: handle CSS sibling combinators in compileCSS - [#8022](mermaid-js/mermaid#8022) [`2cd6dcf`](mermaid-js/mermaid@2cd6dcf) Thanks [@aloisklink](https://github.com/aloisklink)! - fix: increase protections against prototype pollution User-controlled input already has protections against prototype pollution. Fixes: GHSA-c4c3-pg64-4m4v - [#8022](mermaid-js/mermaid#8022) [`99af3fc`](mermaid-js/mermaid@99af3fc) Thanks [@aloisklink](https://github.com/aloisklink)! - fix(architecture): use `Map`s and `Set`s to store groups/services Services are now rendered in the order they are defined and more service IDs are now supported. - [#8022](mermaid-js/mermaid#8022) [`2cd6dcf`](mermaid-js/mermaid@2cd6dcf) Thanks [@aloisklink](https://github.com/aloisklink)! - deprecate: Deprecate the `mermaidAPI.setConfig()` function Calling this function has no observable effect, as the next time a `render()` or `parse()` is called, the `currentConfig` is cleared. - [#8022](mermaid-js/mermaid#8022) [`630aa7e`](mermaid-js/mermaid@630aa7e) Thanks [@aloisklink](https://github.com/aloisklink)! - fix(xychart): support zero-width x-axis ranges - [#8022](mermaid-js/mermaid#8022) [`59b22fa`](mermaid-js/mermaid@59b22fa) Thanks [@aloisklink](https://github.com/aloisklink)! - fix(radar): limit number of ticks to 32 Setting a ticks value higher than this would only show 32 ticks. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: give me a 98K <240642031+inhuman-0@users.noreply.github.com>
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📑 Summary
Adds security fixes for the following issues:
Additionally, we are deprecating the
mermaidAPI.setConfig()function, since it currently doesn't do anything useful.📏 Design Decisions
N/A
📋 Tasks
Make sure you
MERMAID_RELEASE_VERSIONis used for all new features.pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.