build(deps): bump mermaid from 11.6.0 to 11.12.1

[dependabot]

Bumps mermaid from 11.6.0 to 11.12.1.

Release notes

Sourced from mermaid's releases.

mermaid@11.12.1

Patch Changes

• #7107 cbf8946 Thanks @​shubhamparikh2704! - fix: Updated the dependency dagre-d3-es to 7.0.13 to fix GHSA-cc8p-78qf-8p7q

mermaid@11.12.0

Minor Changes

• #6921 764b315 Thanks @​quilicicf! - feat: Add IDs in architecture diagrams

Patch Changes

• #6950 a957908 Thanks @​shubhamparikh2704! - chore: Fix mindmap rendering in docs and apply tidytree layout

• #6826 1d36810 Thanks @​darshanr0107! - fix: Ensure edge label color is applied when using classDef with edge IDs

• #6945 d318f1a Thanks @​darshanr0107! - fix: Resolve gantt chart crash due to invalid array length

• #6918 cfe9238 Thanks @​shubhamparikh2704! - chore: revert marked dependency from ^15.0.7 to ^16.0.0

  • Reverted marked package version to ^16.0.0 for better compatibility
  • This is a dependency update that maintains API compatibility
  • All tests pass with the updated version

mermaid@11.11.0

Minor Changes

• #6704 012530e Thanks @​omkarht! - feat: Added support for new participant types (actor, boundary, control, entity, database, collections, queue) in sequenceDiagram.

• #6802 c8e5027 Thanks @​darshanr0107! - feat: Update mindmap rendering to support multiple layouts, improved edge intersections, and new shapes

Patch Changes

• #6905 33bc4a0 Thanks @​darshanr0107! - fix: Render newlines as spaces in class diagrams

• #6886 e0b45c2 Thanks @​darshanr0107! - fix: Handle arrows correctly when auto number is enabled

mermaid@11.10.1

Patch Changes

• #6886 e0b45c2 Thanks @​darshanr0107! - fix: Handle arrows correctly when auto number is enabled

mermaid@11.10.0

Minor Changes

• #6744 daf8d8d Thanks @​SpecularAura! - feat: Added support for per link curve styling in flowchart diagram using edge ids

Patch Changes

• #6857 b9ef683 Thanks @​knsv! - feat: Exposing elk configuration forceNodeModelOrder and considerModelOrder to the mermaid configuration

... (truncated)

Commits

• 762b44c Merge pull request #7108 from mermaid-js/changeset-release/master
• 02c0091 Version Packages
• 16359ad Merge pull request #7107 from mermaid-js/patch/dagre-d3-es-7.0.13
• 061632c Update .changeset/slick-wasps-bathe.md
• cbf8946 fix: update dagre-d3-es to version 7.0.13
• ad82448 Merge pull request #7053 from mermaid-js/changeset-release/master
• 9498619 Version Packages
• 7a8557a Merge pull request #7036 from mermaid-js/knsv-patch-1
• 74863c9 Merge pull request #7051 from mermaid-js/patch-parser-release
• 63df702 chore: added changeset file
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[jazzberry-ai]

Bug Report

• Name: Incorrect Mermaid Initialization with startOnLoad: true

• Severity: Medium

• Example test case: Add ?testMermaidError=true to the base URL.

• Description: The MermaidRenderer component initializes Mermaid with startOnLoad: true. This setting instructs Mermaid to automatically render diagrams present in the DOM when the page loads. However, the component also dynamically imports the mermaid library and manually calls the mermaid.render function within a useEffect hook.

  This combination can lead to the following issues:

  1. Double Rendering: Mermaid might attempt to render the diagram twice: once automatically due to startOnLoad: true and again when the useEffect hook triggers. This could lead to performance issues or unexpected rendering behavior.
  2. Race Condition: The automatic rendering might occur before the component's useEffect hook has a chance to initialize Mermaid with the desired configuration (theme variables, etc.). This could result in the diagram being rendered with the default Mermaid settings, overriding the component's customizations.

  To fix this, the startOnLoad: true setting should be removed from the Mermaid initialization options. The component should rely solely on the manual mermaid.render call within the useEffect hook to render the diagrams.

_{Comments? Email us.}

[github-actions]

Hey, leave a @claude-review comment below and I'll do a code review!

[jazzberry-ai]

Bug Report

| Name | Severity | Example test case | Description |\n| :---------------------------- | :------- | :------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| XSS in node labels | High | graph TD A[<img src="x" onerror="alert('XSS')">>] --> B | The regex used in fixNodeLabelsWithSpecialChars is not robust and can allow XSS if node labels contain HTML or JavaScript. |\n| XSS via unsanitized output | Medium | graph TD A --> B | The Mermaid output is inserted into the DOM without proper sanitization, potentially leading to XSS if the Mermaid library has vulnerabilities. |

_{Comments? Email us.}

[jazzberry-ai]

Bug Report

Name	Severity	Example test case	Description
XSS vulnerability in Mermaid diagram rendering	High	<MermaidRenderer content={graph LR\n A[Malicious Node " onclick=alert(1) "] --> B\n}/>	The fixNodeLabelsWithSpecialChars function in src/mdx/mermaid.tsx does not properly sanitize node labels, potentially allowing XSS attacks. Malicious JavaScript code can be injected through crafted Mermaid diagrams, leading to arbitrary code execution in the user's browser.

_{Comments? Email us.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.