[dependabot]

Bumps mermaid from 11.17.2 to 12.2.0.

Release notes

Sourced from mermaid's releases.

mermaid@12.2.0

Minor Changes

• #8394 6ac38cb Thanks @​jackroberts236! - feat: Add opt-in mindmap coloring by hierarchy depth using mindmap.colorBy: depth and the existing theme palette.

Patch Changes

• #8409 419ee68 Thanks @​ashishjain0512! - fix: size circle and double-circle nodes from their label instead of minNodeWidth, and trim neo circle padding

• #8395 2fb3ff1 Thanks @​ashishjain0512! - fix: ELK no longer straightens an edge terminal when that would put a label over another edge, or an edge through a label

• #8394 cbf89ab Thanks @​jackroberts236! - fix: Keep mindmap HTML labels readable in the neo look on themes that repaint node backgrounds

• #8390 430ac9b Thanks @​ashishjain0512! - fix: Centre mindmap node labels when htmlLabels is false

• #8161 d7532ed Thanks @​filipsajdak! - fix: scope a swimlane cluster's DOM id like every other cluster, so two diagrams on one page do not collide

• #8270 ad8d61a Thanks @​filipsajdak! - fix(rendering): clip an edge for the layout engine that drew it, so a diagram pinning its own engine (bpmn, swimlanes) still renders when the configured default is another one

• #8383 9d41c0f Thanks @​filipsajdak! - fix(swimlanes): split shared terminal lanes again after crossing cleanup, so an edge that detours around another lane no longer ends on the same attachment point as a neighbouring edge

• #8384 6c67397 Thanks @​filipsajdak! - fix(swimlanes): move a lane's title band clear of an edge that crosses it, in LR diagrams whose lanes carry no direction of their own and when the edge runs along the band's border

• #8366 40124c3 Thanks @​SwastikTripathi! - fix: swimlane nodes with no edges keep their source order inside a lane instead of being sorted by ID

mermaid@12.1.0

Minor Changes

• #8303 9140716 Thanks @​filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

• #8250 fd4f5f2 Thanks @​kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current behaviour, and descending mirrors every row so it reads from that row's highest bit down to its lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram between the two conventions only means changing bitOrder.

Patch Changes

• #8330 50c9e55 Thanks @​ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

• #8259 4c90f5c Thanks @​afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

  participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error, even though the plain form without a config object tolerates trailing whitespace just fine.

• #8339 c7fa1a5 Thanks @​ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

• #8334 d67331d Thanks @​ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

• #8344 99a050b Thanks @​pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

... (truncated)

Commits

• 1fb7869 Merge pull request #8432 from mermaid-js/changeset-release/master
• 34772ca Version Packages
• 42292ea Merge pull request #8428 from mermaid-js/release/12.2.0
• e6c8059 Wrong version set previously
• 6c55f56 Set mermaid version when Coloring by depth supported in Mindmap
• 5a0d8cf Fix missing parallel uploads
• 788f396 Update according to discussion with core-team members
• 33d0a49 Merge pull request #8411 from mermaid-js/renovate/npm-katex-vulnerability
• 6538fde Update dependency katex to ^0.18.0 [SECURITY]
• ba3022d Merge pull request #8398 from mermaid-js/pebr/12.1.0-tmp
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clawhub	Ready	Preview	Oct 16, 2026 4:07pm UTC

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
[chromium] › e2e/local-auth/ publish-skill-lifecycle.pw.test.ts:352:1 › publishing a skill queues scan, queues skill -card generation, and shows the generated card	View Logs
e2e/local-auth/publish-skill-lifecycle.pw.test.ts/ publishing a skill queues scan, queues skill-card generation, and shows the generated c ard	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[clawsweeper]

Codex review: blocked before merge.

What this changes

This PR upgrades Mermaid from 11.17.2 to 12.2.0 and updates its transitive dependencies.

Example: A skill contains the Mermaid diagram graph TD; A --> B without layout configuration.

• Before: The shared renderer uses Mermaid 11's Dagre layout.
• After: The unchanged initializer inherits Mermaid 12's ELK layout.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	The narrowly scoped upgrade retains concrete compatibility defects and conflicts with an existing owner decision.
Proof confidence	🌊 off-meta tidepool	Not applicable: This Dependabot maintenance PR is outside the ordinary contributor proof gate; the supplied deployment status does not establish renderer compatibility.
Patch quality	🦪 silver shellfish (2/6)	2 actionable review findings remain.

Product

Kind: Maintenance · Worth it: No
User problem: The dependency refresh offers upstream rendering fixes and newer transitive packages, but establishes no ClawHub-specific need to change the supported browser contract.
Reason: The existing owner decision prioritizes Safari 15 support over this optional major upgrade, and 12.2.0 does not resolve the verified contract mismatch.

Merge readiness

⛔ Blocked before merge - 6 items remain

Keep open under the repository cleanup policy: main still uses Mermaid 11, and this PR introduces compatibility changes that conflict with recorded maintainer decisions.

Priority: P2
Reviewed head: 9ece8b631fafc6756559f80d2c8c4fd8186d9394

Before merge

• Preserve existing diagram layout and appearance during the upgrade (P1) - MarkdownPreview initializes Mermaid with neutral styling but leaves layout and look implicit. For existing fences such as graph TD; A --> B, upgrading to Mermaid 12 changes the default layout from Dagre to ELK and introduces new appearance defaults. Upstream explicitly identifies this as a breaking rendering change. Preserve the existing layout and classic appearance in the shared initializer if proceeding with this maintenance update.
• Keep Mermaid within the supported browser contract (P2) - The production build still targets Safari 15, while Mermaid 12 declares Safari 17.4+/ES2024 support. In 12.2.0, the use-case parser still enables Chevrotain grammar validation, and the selected Chevrotain 13.2.0 validation calls Object.groupBy. On browsers without that API, this path throws and MarkdownPreview displays source instead of SVG. The earlier maintainer decision at chore(deps): bump mermaid from 11.16.1 to 12.1.0 #3863 (comment) specifically declined this incompatibility; retain the compatible dependency line.
• Complete next step - Determine whether the failed publish-generated-card check is caused by this diff or also fails on the base before assigning CI repair work.
• Product: not worth merging - The existing owner decision prioritizes Safari 15 support over this optional major upgrade, and 12.2.0 does not resolve the verified contract mismatch.
• Explain or restore the original intent of Shared diagram rendering - 229a05a: Render Mermaid fences consistently across shared Markdown consumers with strict security, neutral styling, source fallback, and temporary-node cleanup.
• Explain or restore the original intent of Supported Mermaid dependency line - cf3788c: Refresh compatible dependencies while keeping Mermaid 12 separate; subsequent maintainer discussion explicitly retained Safari 15 support.

Findings

• [P1] Preserve existing diagram layout and appearance during the upgrade — package.json:136
• [P2] Keep Mermaid within the supported browser contract — package.json:136

Provenance

• Shared diagram rendering changes intended behavior without addressing why it exists (229a05a: Render Mermaid fences consistently across shared Markdown consumers with strict security, neutral styling, source fallback, and temporary-node cleanup.)
• Supported Mermaid dependency line changes intended behavior without addressing why it exists (cf3788c: Refresh compatible dependencies while keeping Mermaid 12 separate; subsequent maintainer discussion explicitly retained Safari 15 support.)

Tests

• Missing end-to-end proof: Existing tests do not establish candidate SVG rendering with preserved appearance on the supported Safari floor.

Agent review details

How this fits together

Skill documentation and plugin READMEs enter MarkdownPreview, which renders Mermaid fences as SVG and falls back to source text when rendering fails.

flowchart TD
  A[Skill documentation] --> C[MarkdownPreview]
  B[Plugin README] --> C
  C --> D[Mermaid renderer]
  D --> E[Rendered SVG]
  D --> F[Source fallback]

Loading

Technical review

Best possible solution:

Retain Mermaid 11.17.2 under the recorded browser policy and pursue any major upgrade through a separate compatibility-qualified change.

Do we have a high-confidence way to reproduce the issue?

The layout change follows from the unchanged initializer and candidate schema; the browser mismatch is supported by candidate parser source and the maintainer's explicitly limited earlier missing-API simulation, without a new runtime execution.

Is this the best way to solve the issue?

The version-only update is unsuitable under the recorded compatibility decision; pinning Dagre and classic appearance would address rendering drift but would not resolve the browser floor mismatch, and forcing a transitive KaTeX override was deliberately avoided in prior dependency maintenance.

Full review comments:

• [P1] Preserve existing diagram layout and appearance during the upgrade — package.json:136
  MarkdownPreview initializes Mermaid with neutral styling but leaves layout and look implicit. For existing fences such as graph TD; A --> B, upgrading to Mermaid 12 changes the default layout from Dagre to ELK and introduces new appearance defaults. Upstream explicitly identifies this as a breaking rendering change. Preserve the existing layout and classic appearance in the shared initializer if proceeding with this maintenance update.
  Confidence: 0.99
• [P2] Keep Mermaid within the supported browser contract — package.json:136
  The production build still targets Safari 15, while Mermaid 12 declares Safari 17.4+/ES2024 support. In 12.2.0, the use-case parser still enables Chevrotain grammar validation, and the selected Chevrotain 13.2.0 validation calls Object.groupBy. On browsers without that API, this path throws and MarkdownPreview displays source instead of SVG. The earlier maintainer decision at chore(deps): bump mermaid from 11.16.1 to 12.1.0 #3863 (comment) specifically declined this incompatibility; retain the compatible dependency line.
  Confidence: 0.98

Overall correctness: patch is incorrect
Overall confidence: 0.98

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 6cc4aea3df7c.

Testing

Proof path: unit tests only.

Security

None.

Evidence

What I checked:

• Introduced dependency change: The pinned diff changes only package.json and bun.lock, upgrading Mermaid and its dependency graph; current main retains ^11.17.2. (package.json:136, 9ece8b631faf)
• Shared rendering contract: MarkdownPreview imports Mermaid directly and initializes strict security and neutral styling without pinning layout or look; rendering failures display the original source. The production build targets safari15. (src/components/MarkdownPreview.tsx:144, 6cc4aea3df7c)
• Recorded maintainer direction: vincentkoc declined the earlier major upgrade to preserve Safari 15 support, documenting a scoped Chromium simulation where the new use-case parser fails without Object.groupBy: chore(deps): bump mermaid from 11.16.1 to 12.1.0 #3863 (comment). The decision was reaffirmed at chore(deps): bump mermaid from 11.17.2 to 12.1.0 #3954 (comment); neither is a full Safari run.
• Feature provenance and history: The original Mermaid integration introduced the current initializer in feat: render Mermaid diagrams in markdown #2616. Subsequent dependency maintenance in chore(deps): refresh compatible packages and patch advisories #3953 explicitly kept Mermaid 12 separate. Local historical blob reads failed because promisor objects were unavailable; GitHub commit patches independently established the initializer's introduction. (src/components/MarkdownPreview.tsx:144, 229a05a4c7dc)
• Upstream compatibility contract: ClawHub directly imports this dependency, making its runtime contract applicable. The Mermaid 12 release documents Safari 17.4+/ES2024 requirements and breaking layout changes; the 12.2.0 schema still defaults layout to elk. Its use-case parser constructs a Chevrotain parser with grammar validation enabled. (packages/mermaid/src/schemas/config.schema.yaml:79, 1fb7869866dd)
• Candidate parser runtime requirement: The lockfile selects Chevrotain 13.2.0 for Mermaid's direct parser. Its grammar duplicate validation calls Object.groupBy, confirming that the runtime API implicated in the prior maintainer decision remains in the candidate dependency graph. (packages/chevrotain/src/parse/grammar/checks.ts:105, 221fff765260)

Review metrics

Metric	Value	Why it matters
Patch scope	+18/-12 across 2 dependency files	There are no application changes to accommodate the major version's rendering or browser requirements.

Labels

Label changes:

• add P2: This is dependency maintenance affecting documentation diagrams, with no demonstrated urgent production outage.
• add merge-risk: 🚨 compatibility: The major upgrade changes inherited diagram layouts and exceeds the site's supported Safari runtime floor.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P2: This is dependency maintenance affecting documentation diagrams, with no demonstrated urgent production outage.
• merge-risk: 🚨 compatibility: The major upgrade changes inherited diagram layouts and exceeds the site's supported Safari runtime floor.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🌊 off-meta tidepool and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed October 16, 2026, 12:19 PM ET / 16:19 UTC.

[vincentkoc]

Closing this repeated Mermaid 12 upgrade under the existing owner decision to retain Mermaid 11 while ClawHub supports Safari 15.

Mermaid 12 requires Safari 17.4+. The 12.2 usecase parser still enables Chevrotain grammar validation, whose duplicate-production check calls Object.groupBy. This dependency-only bump does not resolve the documented Safari 15 compatibility gap.

This follows the prior owner decisions on #3863 and #3954. A future Mermaid 12 migration needs an explicit browser-compatibility decision and rendering proof; see the upstream migration notes.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.