Repository navigation
chore: merge v11.16.1 back to the develop branch - #8029
Merged
pbrolin47 merged 17 commits intoAug 5, 2026
Merged
Conversation
Currently, if you have a broken diagram when using `dev/example.html`, then refresh the page, the page breaks. Changing the `await render()` to happen after the event listeners are setup fixes this.
This gets us out of quirks mode and uses proper HTML mode.
Conflicts: - demos/dev/example.html (added the elk layout) - demos/index.html
This adds some improvements to `demos/dev/example.html` (e.g. error handling, showing errors, and timing info) that make it easier to test mermaid locally.
* fix(architecture): handle arbitrary prototype pollution
Update the `ArchitectureGroupAlignments` to use a
`Map<`${string}-${string},` instead of being a
`Record<string, Record<string,`. Not only does this make the code
simpler, but it also means we avoid arbritary prototype pollution
attacks.
Fixes: GHSA-3rrr-jr9j-h3q3
Fixes: cb0a470
* refactor(architecture): use `Map` for registeredIds
* fix(architecture): improve group ID handling
`__proto__`, `constructor`, `toString`, etc. can now be used as a group ID in
architecture diagrams.
* refactor(architecture): use Map for nodes in DB
* refactor(architecture): use Map for spatial maps
* refactor(architecture): use `Set` for visit record
* refactor(architecture): use Map for `adjList`
* refactor(architecture): use Map for elements storage
* refactor(architecture): use Map for alignments
* test(architecture): test for service ID sorting
The old code sorted services by their ID using object iteration order,
which would sort numeric keys before string keys.
Now they are sorted in insertion order, so you can change around the
order of `service` statements in your diagram.
* test(architecture): test for GHSA-3rrr-jr9j-h3q3
Add a modified test to confirm that the prototype pollution in
GHSA-3rrr-jr9j-h3q3 is no longer exploitable.
The current radar diagram renderer adds a very ugly gradient to radar diagrams, even if the number of ticks goes above 30. Because of that, I used 32 as the maximum number of ticks, as anything higher than that doesn't seem to be useable. Just in case people are using a higher number (e.g. accidentally), I've made this only a soft warning, and will continue rendering a radar diagram over the limit, just with 32 ticks instead. Fixes: GHSA-rhh3-jpg6-66xh
* fix(xyChart): fix incorrect spacing, added e2e-test Cherry-picked-from: 46fe731 * fix(xychart): support zero-width x-axis ranges Add support for an x-axis range that has zero-width, e.g. ``` xychart-beta x-axis 0 --> 0 line [1, 2] ``` This also fixes floating-point rounding issues for very large ranges. Fixes: GHSA-2v8p-3f2j-5mp7 --------- Co-authored-by: OG-NI <in.neu@online.de>
* refactor: remove unused `clobber` from `assignWithDepth` * docs: improve `assignWithDepth` documentation Fixes the formatting of the `assignWithDepth` function's TSDoc. * fix: refactor `assignWithDepth` This makes it prototype pollution resistant, and it also handles `null` values like `undefined`. Additionally, I've got rid of more of the `any` types, so it's slightly safer. Fixes: GHSA-c4c3-pg64-4m4v * deprecate: deprecate public `setConfig` function Deprecate the existing `mermaidAPI.setConfig()` function. Calling this function has no observable effect, as the next time a `render()` or `parse()` is called, the `currentConfig` is cleared. * docs: rewrite config function doc comments The function documentation comments in `config.ts` are still using the old pre-typedoc [`documentation`][1] strings. [1]: https://www.npmjs.com/package/documentation * refactor: stop exporting `updateCurrentConfig` This function is only ever exported for one unit test, but since it's exported from this file, it shows up in <https://mermaid.js.org/config/setup/config/README.html> unnecessarily, since it's not exposed anywhere as part of the public mermaid API. * test: test and doc assignWithDepth pollution fix
Stylis compiles `& ~ *` and `& + *` to `#svgId ~ *` / `#svgId + *`,
which select DOM siblings of the SVG element (aka outside of the SVG
boundary).
This commit changes the `addNamespace` middleware to detect when a
selector uses one of these, and namespaces it properly, e.g.
`#svgId ~ *` into `#svgId #svgId ~ *`.
I've also added support for handling the [column combinator `||`][1].
It's experimental, but there's no reason not to handle it.
For `& {`, I had to do some special handling. Technically, it's not
namespaced, but namespacing it with `& &` breaks, and replacing it with
`& > *` overwrites some SVG presentation attributes, so it breaks
existing diagrams. Instead, I've just added a quick check that allows it
if-and-only-if it only has `font-family`, `font-size`, or `fill` rules.
[1]: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Column_combinator
Reported-by: h3ri0s <rohitprasanth8@gmail.com>
See: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Next-sibling_combinator
See: https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/Selectors/Subsequent-sibling_combinator
Fixes: 6476973
We used squash merges, so the original commit IDs no longer exist.
Release Candidate 11.16.1
Technically, under semver, deprecations are supposed to be `minor` version bumps, but considering that this function is currently broken and not doing anything, and has been broken for a while, I think we can make this a `patch` version instead.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
The v11.16.1 hotfixes skipped the `develop` branch, so we should merge these in now to avoid merge conflicts in the future.
|
✅ Deploy Preview for mermaid-js ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughMermaid 11.16.1 updates configuration handling, architecture data structures, CSS namespacing, XYChart and radar rendering, the development page, API documentation, tests, and package metadata. ChangesMermaid 11.16.1
Estimated code review effort: 4 (Complex) | ~45 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
@mermaid-js/examples
mermaid
@mermaid-js/layout-elk
@mermaid-js/layout-tidy-tree
@mermaid-js/mermaid-zenuml
@mermaid-js/parser
@mermaid-js/tiny
commit: |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Actionable comments posted: 4
🧹 Nitpick comments (2)
packages/mermaid/src/diagrams/architecture/architectureRenderer.ts (1)
321-347: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueConsider a
Setforvisitedto match the surrounding Map/Set migration.
visitedat line 331 is still a plain object used as a lookup table. The keys are generated fromposToStr, so they always match${number},${number}and cannot collide with prototype keys. There is no correctness or security defect here. ASet<string>would align this last structure with the rest of the migration and remove theRecordindex type.♻️ Proposed refactor
- const visited: Record<ReturnType<typeof posToStr>, number> = {}; + const visited = new Set<ReturnType<typeof posToStr>>();Then update the two use sites:
- visited[curr] = 1; + visited.add(curr);- if (newId && !visited[newPos]) { + if (newId && !visited.has(newPos)) {🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@packages/mermaid/src/diagrams/architecture/architectureRenderer.ts` around lines 321 - 347, Replace the plain-object visited lookup in the BFS around spatialMaps with a Set<string>, initializing it without the Record type; update both visited write and membership-check sites to use Set operations while preserving the existing traversal behavior.demos/dev/example.html (1)
1-1: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winKeep the development-page warning after the doctype.
<!doctype html>must remain first for standards mode. Restore the existing instructions that tell developers to duplicate this file before editing it.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@demos/dev/example.html` at line 1, Keep <!doctype html> as the first line of the development page, then restore the existing developer warning and instructions to duplicate the file before editing it.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@demos/dev/example.html`:
- Around line 82-85: Update the render failure handler’s catch block to clear
the existing content in `#dynamicDiagram` before displaying the error in `#errors`,
while preserving the setRenderTime(start, end) call.
In `@packages/mermaid/CHANGELOG.md`:
- Around line 25-27: Update the 11.16.1 entries in packages/mermaid/CHANGELOG.md
at lines 25-27 and packages/tiny/CHANGELOG.md at lines 25-27 to document the
missing XYChart spacing and floating-point rounding fixes, while retaining the
existing zero-width x-axis range entry. Keep both changelogs aligned with the
shipped XYChart fixes.
In `@packages/mermaid/src/assignWithDepth.ts`:
- Around line 48-53: The depth-boundary branch in assignWithDepth must avoid
Object.assign, which can trigger a source __proto__ setter. In
packages/mermaid/src/assignWithDepth.ts lines 48-53, replace that copy with an
own-enumerable-property iteration that safely handles __proto__ without mutating
dst’s prototype; preserve the existing return behavior for non-object values. In
packages/mermaid/src/utils.spec.ts lines 84-95, update or add coverage for an
own enumerable __proto__ source property and verify the destination prototype
remains unchanged.
In `@packages/mermaid/src/diagrams/architecture/architectureDb.ts`:
- Around line 214-226: Update addEdge to safely resolve lhsGroupId and
rhsGroupId when an endpoint exists only in groups: treat this.nodes.get(lhsId)
or this.nodes.get(rhsId) as optional before reading .in, while preserving
group-id handling for downstream rendering and existing validation.
---
Nitpick comments:
In `@demos/dev/example.html`:
- Line 1: Keep <!doctype html> as the first line of the development page, then
restore the existing developer warning and instructions to duplicate the file
before editing it.
In `@packages/mermaid/src/diagrams/architecture/architectureRenderer.ts`:
- Around line 321-347: Replace the plain-object visited lookup in the BFS around
spatialMaps with a Set<string>, initializing it without the Record type; update
both visited write and membership-check sites to use Set operations while
preserving the existing traversal behavior.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 49fa2176-0730-4d31-8ea5-4af0e738be58
📒 Files selected for processing (34)
.cspell/misc-terms.txtcypress/integration/rendering/xychart/xyChart.spec.jsdemos/dev/example.htmldocs/config/setup/config/README.mddocs/config/setup/config/functions/addDirective.mddocs/config/setup/config/functions/getConfig.mddocs/config/setup/config/functions/getEffectiveHtmlLabels.mddocs/config/setup/config/functions/getSiteConfig.mddocs/config/setup/config/functions/getUserDefinedConfig.mddocs/config/setup/config/functions/reset.mddocs/config/setup/config/functions/sanitize.mddocs/config/setup/config/functions/saveConfigFromInitialize.mddocs/config/setup/config/functions/setConfig.mddocs/config/setup/config/functions/setSiteConfig.mddocs/config/setup/config/functions/updateCurrentConfig.mddocs/config/setup/config/functions/updateSiteConfig.mdpackages/mermaid/CHANGELOG.mdpackages/mermaid/package.jsonpackages/mermaid/src/assignWithDepth.tspackages/mermaid/src/config.spec.tspackages/mermaid/src/config.tspackages/mermaid/src/diagrams/architecture/architecture.spec.tspackages/mermaid/src/diagrams/architecture/architectureDb.tspackages/mermaid/src/diagrams/architecture/architectureRenderer.tspackages/mermaid/src/diagrams/architecture/architectureTypes.tspackages/mermaid/src/diagrams/radar/db.tspackages/mermaid/src/diagrams/radar/radar.spec.tspackages/mermaid/src/diagrams/xychart/xychartDb.tspackages/mermaid/src/mermaidAPI.spec.tspackages/mermaid/src/mermaidAPI.tspackages/mermaid/src/styles.tspackages/mermaid/src/utils.spec.tspackages/tiny/CHANGELOG.mdpackages/tiny/package.json
💤 Files with no reviewable changes (1)
- docs/config/setup/config/functions/updateCurrentConfig.md
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## develop #8029 +/- ##
===========================================
+ Coverage 77.66% 77.67% +0.01%
===========================================
Files 567 567
Lines 74906 74968 +62
Branches 12657 12682 +25
===========================================
+ Hits 58172 58234 +62
- Misses 15739 15740 +1
+ Partials 995 994 -1
Flags with carried forward coverage won't be shown. Click here to find out more.
🚀 New features to boost your workflow:
|
|
The latest updates on your projects. Learn more about Argos notifications ↗︎
|
pbrolin47
approved these changes
Aug 5, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📑 Summary
The v11.16.1 hotfixes skipped the
developbranch, so we should merge these intodevelopnow to avoid merge conflicts in the future.📏 Design Decisions
N/A
📋 Tasks
Make sure you
MERMAID_RELEASE_VERSIONis used for all new features.pnpm changesetand following the prompts. Changesets that add features should beminorand those that fix bugs should bepatch. Please prefix changeset messages withfeat:,fix:, orchore:.Summary
This PR merges the v11.16.1 hotfixes into
develop.Changes
Mapinstances and preserve service ordering.mermaidAPI.setConfig()and removed the exportedupdateCurrentConfig.demos/dev/example.htmlwith render timing and error reporting.API impact
assignWithDepthno longer accepts theclobberoption.updateCurrentConfigis now module-local.mermaidAPI.setConfig()is deprecated.