[dependabot]

Bumps mermaid from 11.16.1 to 12.1.0.

Release notes

Sourced from mermaid's releases.

mermaid@12.1.0

Minor Changes

• #8303 9140716 Thanks @​filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

• #8250 fd4f5f2 Thanks @​kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current behaviour, and descending mirrors every row so it reads from that row's highest bit down to its lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram between the two conventions only means changing bitOrder.

Patch Changes

• #8330 50c9e55 Thanks @​ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

• #8259 4c90f5c Thanks @​afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

  participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error, even though the plain form without a config object tolerates trailing whitespace just fine.

• #8339 c7fa1a5 Thanks @​ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

• #8334 d67331d Thanks @​ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

• #8344 99a050b Thanks @​pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

• #8276 3101c7d Thanks @​mir-ashiq! - fix(error): show the actual error message in the error diagram

  When a diagram fails to parse, the error diagram now draws the real error message below the "Syntax error in text" headline, wrapped to at most four lines. Hosts that only show the SVG (GitHub, GitLab, Obsidian, exported images) no longer hide what actually went wrong, e.g. that the flowchart edge limit was exceeded and maxEdges needs raising via mermaid.initialize.

• #8296 aa29345 Thanks @​pentaoa! - fix: preserve explicit source relations on event modeling reset frames

• #8297 967bbde Thanks @​pentaoa! - fix: reject duplicate event modeling frame IDs before rendering

• #8337 147f343 Thanks @​knsv-bot! - fix: a flowchart that declares the same subgraph id more than once now renders as one merged subgraph with the ELK layout instead of producing NaN geometry. Classes and view: collapsed set on a repeated subgraph now apply to it, whichever declaration they follow.

• #8203 40ef7b4 Thanks @​MFA-G! - perf(frontmatter): replace the quadratic front matter regex on hot paths

  frontMatterRegex backtracks polynomially on whitespace-heavy input, so a diagram well inside the default maxTextSize could stall parsing for over a second. detectType and extractFrontMatter now use a linear scanner that matches the regex result exactly, leaving no document stripped differently.

• #8254 351d7d2 Thanks @​galshir! - fix: warn when a gantt task references an unknown after/until task id, or when its end value is neither a valid date nor a valid duration

• #8249 b657a2c Thanks @​mir-ashiq! - fix(sequence): allow hyphenated actor and participant names when a config object is attached

... (truncated)

Commits

• 21f72f0 Merge pull request #8360 from mermaid-js/changeset-release/master
• 3f89f7b Version Packages
• 4ef0218 Merge pull request #8358 from mermaid-js/release/12.0.1
• f45c691 Fix error from build docs
• d9cb282 Fix label overlap bug
• 47fffa0 Merge pull request #8297 from pentaoa/fix/eventmodeling-duplicate-frame-ids
• 12c280e Merge develop and preserve eventmodeling regression tests
• c0f7052 Merge pull request #8296 from pentaoa/fix/eventmodeling-reset-explicit-relations
• 4f6ac96 Merge pull request #8345 from mermaid-js/bug/8283_xychart-legend-clip-title-h...
• 679093a Merge pull request #8344 from mermaid-js/pebr/issue-8292-elk-label
• Additional commits viewable in compare view

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 14, 2026 5:01am UTC

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR upgrades Mermaid to 12.1.0 and explicitly preserves Dagre layout and classic appearance in the shared Markdown renderer.

Example: A published SKILL.md contains graph TD\n A --> B in a Mermaid fence.

• Before: Mermaid 11.16.1 renders it with neutral styling and the existing layout defaults.
• After: Mermaid 12.1.0 receives explicit neutral, Dagre, and classic settings to preserve its appearance.

Review scores

Measure	Result	What it means
Overall readiness	🧂 unranked krab (1/6)	The earlier appearance defect is repaired and no discrete introduced bug is established, but required visual evidence is absent and browser compatibility remains unresolved.
Proof confidence	🧂 unranked krab (1/6)	Real behavior proof is not required for maintainer- or bot-authored pull requests.
Patch quality	🦐 gold shrimp (3/6)	No actionable review findings were identified.

Product

Kind: Maintenance · Worth it: Yes · Fix scope: Complete
User problem: Users should continue seeing published Mermaid diagrams with their existing appearance when the rendering dependency is updated.
Reason: The maintainer discussion supports the focused upgrade and appearance preservation while requiring the existing browser compatibility contract to hold.

Merge readiness

⛔ Blocked before merge - 2 items remain

Keep this PR open: current main still uses Mermaid 11.16.1, and maintainer-engaged work remains on browser compatibility; the earlier appearance finding is resolved.

Priority: P2
Reviewed head: b87f9c97a673a62494e71a85ee5268317794fe49

Before merge

• Resolve merge risk - Before merge, establish that the built Mermaid 12.1.0 renderer works on Safari 15 and repair any demonstrated incompatibility; otherwise older supported browsers may show source instead of diagrams.
• Complete next step - Resolve the merge conflict GitHub reports for this PR.

Findings

None.

Tests

• Missing end-to-end proof: Supply a real ClawHub browser capture of a published diagram on this candidate; the added test checks configuration rather than successful rendered output.

Agent review details

How this fits together

Skill pages, plugin READMEs, and scanner reports pass Markdown into MarkdownPreview, which loads Mermaid for diagram fences and displays SVG or the original source on failure.

flowchart TD
  A[Skill and plugin Markdown] --> B[MarkdownPreview]
  B --> C[Mermaid fence detection]
  C --> D[Mermaid initialization]
  D --> E[Diagram rendering]
  E --> F[SVG display]
  E --> G[Source fallback]

Loading

Technical review

Best possible solution:

Keep the explicit appearance settings and land the upgrade only after Safari 15 compatibility is established, retaining Mermaid 11 if it cannot be preserved.

Do we have a high-confidence way to reproduce the issue?

This is dependency maintenance rather than a reported current-main bug; the browser-floor mismatch is source-verified, but no Safari runtime failure was reproduced.

Is this the best way to solve the issue?

The shared renderer is the correct place to preserve appearance; changing the browser target would broaden scope, so qualify the bundle and repair only demonstrated incompatibilities.

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 0bf64843c697.

Merge-risk options

Maintainer options:

1. Qualify and preserve Safari 15 support (recommended)
   Exercise the actual production renderer on Safari 15 and add only the narrowly demonstrated compatibility repair.
2. Defer the major upgrade
   Retain Mermaid 11.16.1 until Mermaid 12 can meet the existing browser target.

Provenance checked

• Shared Mermaid initialization keeps the original intent (feat: render Mermaid diagrams in markdown #2616: Render Mermaid fences across shared Markdown consumers with strict security, neutral styling, and cleanup on failure.)
• Mermaid dependency pin changes intended behavior with a stated reason (chore: restore a clean bun audit so CI stops failing on every branch #3446: Move to the first patched Mermaid release to clear dependency advisories without an unnecessary major upgrade.)

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Verified introduced change: The pinned introduction changes only the dependency declaration, corresponding lock entries, renderer defaults, focused test, and changelog; strict security remains enabled. (src/components/MarkdownPreview.tsx:144, b87f9c97a673)
• Not implemented on current main: Current main declares ^11.16.1 and resolves Mermaid 11.16.1; its renderer has no explicit layout or look settings. (bun.lock:1546, 0bf64843c697)
• Supported bundle target: The production client build targets safari15, while the patch provides no additional runtime compatibility handling. (vite.config.ts:222, 0bf64843c697)
• Authoritative dependency contract: MarkdownPreview directly imports Mermaid, making its runtime contract applicable. The Mermaid 12 release notes document ES2024 and Safari 17.4+, suggest transpilation or polyfills for older browsers, and prescribe explicit layout and appearance settings: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4012.0.0.
• Maintainer direction and qualification requirement: vincentkoc confirms the appearance repair and successful CI retry, but requests qualification of the built renderer on Safari 15; the comment explicitly claims no candidate browser capture: chore(deps): bump mermaid from 11.16.1 to 12.1.0 #3863 (comment). (b87f9c97a673)
• Renderer provenance: Merged feat: render Mermaid diagrams in markdown #2616 introduced shared Mermaid rendering, neutral styling, strict security, and failed-render cleanup; the patch preserves those decisions. (src/components/MarkdownPreview.tsx:143, 229a05a4c7dc)

Likely related people:

• Patrick Erichsen: Raw commit 229a05a adds src/components/MarkdownPreview.tsx:93 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 229a05a4c7dc; files: src/components/MarkdownPreview.tsx)

Review metrics

Metric	Value	Why it matters
Patch size	+34/-6 across 5 files	The focused change adds three production renderer lines and twelve test lines; most growth is the dependency lock update.

Labels

Label changes:

• add merge-risk: 🚨 compatibility: Mermaid 12 documents a Safari 17.4 floor while ClawHub targets Safari 15, and the maintainer has not accepted dropping that support.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.
• remove status: 👀 ready for maintainer look: Current PR status label is status: ⏳ waiting on author.

Label justifications:

• P2: This is a focused dependency upgrade affecting Markdown diagrams, with no established urgent current-main failure.
• merge-risk: 🚨 compatibility: Mermaid 12 documents a Safari 17.4 floor while ClawHub targets Safari 15, and the maintainer has not accepted dropping that support.
• rating: 🧂 unranked krab: Overall readiness is 🧂 unranked krab; proof is 🧂 unranked krab and patch quality is 🦐 gold shrimp.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rank-up moves

Optional improvements that raise the rating; they are not merge blockers.

• Attach a real candidate browser capture of a published Mermaid diagram.
• Demonstrate that the production renderer preserves Safari 15 support.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

History

Review history (38 earlier review cycles; latest 8 shown)

• reviewed 2026-10-11T11:20:17.616Z sha 7362f85 :: blocked before merge. :: [P1] Preserve existing Mermaid appearance during the upgrade
• reviewed 2026-10-12T03:28:03.619Z sha 96c8394 :: needs changes before merge. :: [P1] Preserve existing Mermaid appearance during the upgrade
• reviewed 2026-10-13T05:44:10.018Z sha 96c8394 :: needs changes before merge. :: [P1] Preserve existing Mermaid appearance during the upgrade
• reviewed 2026-10-13T16:43:44.198Z sha 96c8394 :: needs changes before merge. :: [P1] Preserve existing Mermaid appearance during the upgrade
• reviewed 2026-10-13T20:39:36.816Z sha 96c8394 :: needs changes before merge. :: [P1] Preserve existing Mermaid appearance during the upgrade
• reviewed 2026-10-14T01:40:01.336Z sha 96c8394 :: needs changes before merge. :: [P1] Preserve existing Mermaid appearance during the upgrade
• reviewed 2026-10-14T04:43:41.416Z sha 4a55f4b :: needs maintainer review before merge. :: none
• reviewed 2026-10-14T05:02:19.259Z sha b87f9c9 :: blocked before merge. :: none

Reviewed October 14, 2026, 2:20 AM ET / 06:20 UTC (Revision 39).

[vincentkoc]

@clawsweeper re-review

[clawsweeper]

🦞👀
Exact review queued.

Re-review progress:

• State: Complete
• Detail: The durable review result and its route handoff completed.
• Run: https://github.com/openclaw/clawsweeper/actions/runs/38514580635
• Updated: 2026-10-14T05:03:26.592Z

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​mermaid@​11.16.1 ⏵ 12.1.0	+1		+1

View full report

[vincentkoc]

Audit at b87f9c9: appearance is explicitly pinned to neutral/Dagre/classic, and CI now passes after retrying the isolated local Convex capacity failure. This remains open because Mermaid 12 documents a Safari 17.4/ES2024 floor while our production bundle targets Safari 15 (vite.config.ts). The new parser graph includes Object.groupBy, which requires Safari 17.4; syntax transpilation alone does not establish runtime compatibility. The reviewed preview requires Vercel SSO, so no real candidate browser capture or Safari 15 proof is claimed. Before landing, qualify the actual built renderer on the supported browser floor and supply any demonstrated, narrowly scoped compatibility repair. Upstream contract: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4012.0.0

[vincentkoc]

Closing this optional major upgrade while ClawHub keeps its Safari 15 browser target and Mermaid 11.16.1.

Mermaid 12 declares Safari 17.4+ support. I tested its published 12.1.0 bundle with ClawHub’s neutral/strict/Dagre/classic settings: the official usecase-beta example renders SVG normally, but fails with Object.groupBy is not a function when that API is absent. Its direct Chevrotain parser enables grammar validation and reaches that call. Safari added the API in 17.4; Vite’s browser target does not polyfill runtime APIs. See the upstream runtime contract, use-case parser, and browser compatibility data.

This was a focused missing-API simulation in Chromium, not a full Safari 15 run. Flowchart, sequence, and architecture examples passed with Object.groupBy absent in both versions; the demonstrated failure is the new use-case parser. The Langium production path skips this validation. Preserving the current browser contract takes priority over adding a global polyfill, vendor patch, or browser-floor change for this bot upgrade. Thanks to Dependabot for the update; no code or browser-policy changes are being landed.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.