fix(security): update dependency mermaid to v11.10.0 [security] (#1255)

renovate[bot] · web-flow · commit c5b1784a9fdf · 2025-08-29T23:27:04.000Z
This PR contains the following updates: | Package | Change | Age | Confidence | |---|---|---|---| | [mermaid](https://redirect.github.com/mermaid-js/mermaid) | [`11.8.0` -> `11.10.0`](https://renovatebot.com/diffs/npm/mermaid/11.8.0/11.10.0) | [![age](https://developer.mend.io/api/mc/badges/age/npm/mermaid/11.10.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | [![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/mermaid/11.8.0/11.10.0?slim=true)](https://docs.renovatebot.com/merge-confidence/) | ### GitHub Vulnerability Alerts #### [CVE-2025-54880](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-8gwm-58g9-j8pw) ### Summary In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 `html()` method, creating a sink for cross site scripting. ### Details Architecture diagram service `iconText` values are passed to the d3 `html()` method, allowing malicious users to inject arbitrary HTML and cause XSS when mermaid-js is used in it's default configuration. The vulnerability lies here: ```ts export const drawServices = async function ( db: ArchitectureDB, elem: D3Element, services: ArchitectureService[] ): Promise<number> { for (const service of services) { /** ... **/ } else if (service.iconText) { bkgElem.html( `<g>${await getIconSVG('blank', { height: iconSize, width: iconSize, fallbackPrefix: architectureIcons.prefix })}</g>` ); const textElemContainer = bkgElem.append('g'); const fo = textElemContainer .append('foreignObject') .attr('width', iconSize) .attr('height', iconSize); const divElem = fo .append('div') .attr('class', 'node-icon-text') .attr('style', `height: ${iconSize}px;`) .append('div') .html(service.iconText); // <- iconText passed into innerHTML /** ... **/ }; }; ``` This issue was introduced with 734bde38777c9190a5a72e96421c83424442d4e4, around 15 months ago, which was released in [v11.1.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.1.0). ### PoC Render the following diagram and observe the modified DOM. ``` architecture-beta group api(cloud)[API] service db "<img src=x onerror=\"document.write(`xss on ${document.domain}`)\">" [Database] in api ``` Here is a PoC on mermaid.live: https://mermaid.live/edit#pako:eNo9T8FOwzAM_ZXI4rBJpWrpRtuIISF24caZZdKyxOsiLUnlJjCo-u9kQ8wX-_n5-dkjKK8ROEhSRxNQhUh4v8cghWMpOvKxZ7I3M3XyUc83L-9v2z9qQPo0CpneMwFPxnZsILU6M--QyNNKCAHaq2jRhfyL0vLZ7jwMiWd3443Q3krjpt38Mv4sgG3WMsi9HHDLjLs4CwcZdGQ08EARM7BISZMgjJdLBIQjWhTAU6nxIOMpCBBuSrJeug_v7b8yPdMdgR_kaUgo9loGXBvZkbS3LqHTSK8-ugC8LMrrEuAjnIEvlnlVL9q6rZu6Lh-rRQbfwKuyyZuybcvqIaWiqKcMfq6uRd7Uy-kXhYFzcA ### Impact XSS on all sites that use mermaid and render user supplied diagrams without further sanitization. ### Remediation Sanitize the value of `iconText` before passing it to `html()`. #### [CVE-2025-54881](https://redirect.github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh) ### Summary In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to `innerHTML` during calculation of element size, causing XSS. ### Details Sequence diagram node labels with KaTeX delimiters are passed through `calculateMathMLDimensions`. This method passes the full label to `innerHTML` which allows allows malicious users to inject arbitrary HTML and cause XSS when mermaid-js is used in it's default configuration (with KaTeX support enabled). The vulnerability lies here: ```ts export const calculateMathMLDimensions = async (text: string, config: MermaidConfig) => { text = await renderKatex(text, config); const divElem = document.createElement('div'); divElem.innerHTML = text; // XSS sink, text has not been sanitized. divElem.id = 'katex-temp'; divElem.style.visibility = 'hidden'; divElem.style.position = 'absolute'; divElem.style.top = '0'; const body = document.querySelector('body'); body?.insertAdjacentElement('beforeend', divElem); const dim = { width: divElem.clientWidth, height: divElem.clientHeight }; divElem.remove(); return dim; }; ``` The `calculateMathMLDimensions` method was introduced in 5c69e5fdb004a6d0a2abe97e23d26e223a059832 two years ago, which was released in [Mermaid 10.9.0](https://redirect.github.com/mermaid-js/mermaid/releases/tag/v10.9.0). ### PoC Render the following diagram and observe the modified DOM. ``` sequenceDiagram participant A as Alice<img src="x" onerror="document.write(`xss on ${document.domain}`)">$$\\text{Alice}$$ A->>John: Hello John, how are you? Alice-)John: See you later! ``` Here is a PoC on mermaid.live: https://mermaid.live/edit#pako:eNpVUMtOwzAQ_BWzyoFKaRTyaFILiio4IK7ckA-1km1iKbaLY6spUf4dJ0AF68uOZ2dm7REqXSNQ6PHDoarwWfDGcMkUudaJGysqceLKkj3hPdl3osJ7IRvSm-qBwcCAaIXGaONRrSsnUdnobITF28PQ954lwXglai25UNNhxWAXBMyXxcGOi-3kL_5k79e73atuFSUv2HWazH1IWn0m3CC5aPf4b3p2WK--BW-4DJCOWzQ3TM0HQmiMqIFa4zAEicZv4iGMsw0D26JEBtS3NR656ywDpiYv869_11r-Ko12TQv0yLveI3eqfcjP111HUNVonrRTFuhdsVgAHWEAmuRxlG7SuEzKMi-yJAnhAjTLIk_EcbFJtuk2y9MphM8lM47KIp--AOZghtU ### Impact XSS on all sites that use mermaid and render user supplied diagrams without further sanitization. ### Remediation The value of the `text` argument for the `calculateMathMLDimensions` method needs to be sanitized before getting passed on to `innerHTML`. --- ### Release Notes <details> <summary>mermaid-js/mermaid (mermaid)</summary> ### [`v11.10.0`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.10.0) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.9.0...mermaid@11.10.0) ##### Minor Changes - [#&#8203;6744](https://redirect.github.com/mermaid-js/mermaid/pull/6744) [`daf8d8d`](https://redirect.github.com/mermaid-js/mermaid/commit/daf8d8d3befcd600618a629977b76463b38d0ad9) Thanks [@&#8203;SpecularAura](https://redirect.github.com/SpecularAura)! - feat: Added support for per link curve styling in flowchart diagram using edge ids ##### Patch Changes - [#&#8203;6857](https://redirect.github.com/mermaid-js/mermaid/pull/6857) [`b9ef683`](https://redirect.github.com/mermaid-js/mermaid/commit/b9ef683fb67b8959abc455d6cc5266c37ba435f6) Thanks [@&#8203;knsv](https://redirect.github.com/knsv)! - feat: Exposing elk configuration forceNodeModelOrder and considerModelOrder to the mermaid configuration - [#&#8203;6653](https://redirect.github.com/mermaid-js/mermaid/pull/6653) [`2c0931d`](https://redirect.github.com/mermaid-js/mermaid/commit/2c0931da46794b49d2523211e25f782900c34e94) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - chore: Remove the "-beta" suffix from the XYChart, Block, Sankey diagrams to reflect their stable status - [#&#8203;6683](https://redirect.github.com/mermaid-js/mermaid/pull/6683) [`33e08da`](https://redirect.github.com/mermaid-js/mermaid/commit/33e08daf175125295a06b1b80279437004a4e865) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix: Position the edge label in state diagram correctly relative to the edge - [#&#8203;6693](https://redirect.github.com/mermaid-js/mermaid/pull/6693) [`814b68b`](https://redirect.github.com/mermaid-js/mermaid/commit/814b68b4a94813f7c6b3d7fb4559532a7bab2652) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix: Apply correct dateFormat in Gantt chart to show only day when specified - [#&#8203;6734](https://redirect.github.com/mermaid-js/mermaid/pull/6734) [`fce7cab`](https://redirect.github.com/mermaid-js/mermaid/commit/fce7cabb71d68a20a66246fe23d066512126a412) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix: handle exclude dates properly in Gantt charts when using dateFormat: 'YYYY-MM-DD HH:mm:ss' - [#&#8203;6733](https://redirect.github.com/mermaid-js/mermaid/pull/6733) [`fc07f0d`](https://redirect.github.com/mermaid-js/mermaid/commit/fc07f0d8abca49e4f887d7457b7b94fb07d1e3da) Thanks [@&#8203;omkarht](https://redirect.github.com/omkarht)! - fix: fixed connection gaps in flowchart for roundedRect, stadium and diamond shape - [#&#8203;6876](https://redirect.github.com/mermaid-js/mermaid/pull/6876) [`12e01bd`](https://redirect.github.com/mermaid-js/mermaid/commit/12e01bdb5cacf3569133979a5a4f1d8973e9aec1) Thanks [@&#8203;sidharthv96](https://redirect.github.com/sidharthv96)! - fix: sanitize icon labels and icon SVGs Resolves CVE-2025-54880 reported by [@&#8203;fourcube](https://redirect.github.com/fourcube) - [#&#8203;6801](https://redirect.github.com/mermaid-js/mermaid/pull/6801) [`01aaef3`](https://redirect.github.com/mermaid-js/mermaid/commit/01aaef39b4a1ec8bc5a0c6bfa3a20b712d67f4dc) Thanks [@&#8203;sidharthv96](https://redirect.github.com/sidharthv96)! - fix: Update casing of ID in requirement diagram - [#&#8203;6796](https://redirect.github.com/mermaid-js/mermaid/pull/6796) [`c36cd05`](https://redirect.github.com/mermaid-js/mermaid/commit/c36cd05c45ac3090181152b4dae41f8d7b569bd6) Thanks [@&#8203;HashanCP](https://redirect.github.com/HashanCP)! - fix: Make flowchart elk detector regex match less greedy - [#&#8203;6702](https://redirect.github.com/mermaid-js/mermaid/pull/6702) [`8bb29fc`](https://redirect.github.com/mermaid-js/mermaid/commit/8bb29fc879329ad109898e4025b4f4eba2ab0649) Thanks [@&#8203;qraqras](https://redirect.github.com/qraqras)! - fix(block): overflowing blocks no longer affect later lines This may change the layout of block diagrams that have overflowing lines (i.e. block diagrams that use up more columns that the `columns` specifier). - [#&#8203;6717](https://redirect.github.com/mermaid-js/mermaid/pull/6717) [`71b04f9`](https://redirect.github.com/mermaid-js/mermaid/commit/71b04f93b07f876df2b30656ef36036c1d0e4e4f) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix: log warning for blocks exceeding column width This update adds a validation check that logs a warning message when a block's width exceeds the defined column layout. - [#&#8203;6820](https://redirect.github.com/mermaid-js/mermaid/pull/6820) [`c99bce6`](https://redirect.github.com/mermaid-js/mermaid/commit/c99bce6bab4c7ce0b81b66d44f44853ce4aeb1c3) Thanks [@&#8203;kriss-u](https://redirect.github.com/kriss-u)! - fix: Add escaped class literal name on namespace - [#&#8203;6332](https://redirect.github.com/mermaid-js/mermaid/pull/6332) [`6cc1926`](https://redirect.github.com/mermaid-js/mermaid/commit/6cc192680a2531cab28f87a8061a53b786e010f3) Thanks [@&#8203;ajuckel](https://redirect.github.com/ajuckel)! - fix: Allow equals sign in sequenceDiagram labels - [#&#8203;6651](https://redirect.github.com/mermaid-js/mermaid/pull/6651) [`9da6fb3`](https://redirect.github.com/mermaid-js/mermaid/commit/9da6fb39ae278401771943ac85d6d1b875f78cf1) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - Add validation for negative values in pie charts: Prevents crashes during parsing by validating values post-parsing. Provides clearer, user-friendly error messages for invalid negative inputs. - [#&#8203;6803](https://redirect.github.com/mermaid-js/mermaid/pull/6803) [`e48b0ba`](https://redirect.github.com/mermaid-js/mermaid/commit/e48b0ba61dab7f95aa02da603b5b7d383b894932) Thanks [@&#8203;omkarht](https://redirect.github.com/omkarht)! - chore: migrate to class-based ArchitectureDB implementation - [#&#8203;6838](https://redirect.github.com/mermaid-js/mermaid/pull/6838) [`4d62d59`](https://redirect.github.com/mermaid-js/mermaid/commit/4d62d5963238400270e9314c6e4d506f48147074) Thanks [@&#8203;saurabhg772244](https://redirect.github.com/saurabhg772244)! - fix: node border style for handdrawn shapes - [#&#8203;6739](https://redirect.github.com/mermaid-js/mermaid/pull/6739) [`e9ce8cf`](https://redirect.github.com/mermaid-js/mermaid/commit/e9ce8cf4da9062d85098042044822100889bb0dd) Thanks [@&#8203;kriss-u](https://redirect.github.com/kriss-u)! - fix: Update flowchart direction TD's behavior to be the same as TB - [#&#8203;6833](https://redirect.github.com/mermaid-js/mermaid/pull/6833) [`9258b29`](https://redirect.github.com/mermaid-js/mermaid/commit/9258b2933bbe1ef41087345ffea3731673671c49) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix: correctly render non-directional lines for '---' in block diagrams - [#&#8203;6855](https://redirect.github.com/mermaid-js/mermaid/pull/6855) [`da90f67`](https://redirect.github.com/mermaid-js/mermaid/commit/da90f6760b6efb0da998bcb63b75eecc29e06c08) Thanks [@&#8203;sidharthv96](https://redirect.github.com/sidharthv96)! - fix: fallback to raw text instead of rendering *Unsupported markdown* or empty blocks Instead of printing **Unsupported markdown: XXX**, or empty blocks when using a markdown feature that Mermaid does not yet support when `htmlLabels: true`(default) or `htmlLabels: false`, fallback to the raw markdown text. - [#&#8203;6876](https://redirect.github.com/mermaid-js/mermaid/pull/6876) [`0133f1c`](https://redirect.github.com/mermaid-js/mermaid/commit/0133f1c0c5cff4fc4c8e0b99e9cf0b3d49dcbe71) Thanks [@&#8203;sidharthv96](https://redirect.github.com/sidharthv96)! - fix: sanitize KATEX blocks Resolves CVE-2025-54881 reported by [@&#8203;fourcube](https://redirect.github.com/fourcube) - [#&#8203;6804](https://redirect.github.com/mermaid-js/mermaid/pull/6804) [`895f9d4`](https://redirect.github.com/mermaid-js/mermaid/commit/895f9d43ff98ca05ebfba530789f677f31a011ff) Thanks [@&#8203;omkarht](https://redirect.github.com/omkarht)! - chore: Update packet diagram to use new class-based database structure ### [`v11.9.0`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.9.0) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.8.1...mermaid@11.9.0) ##### Minor Changes - [#&#8203;6453](https://redirect.github.com/mermaid-js/mermaid/pull/6453) [`5acbd7e`](https://redirect.github.com/mermaid-js/mermaid/commit/5acbd7e762469d9d89a9c77faf6617ee13367f3a) Thanks [@&#8203;sidharthv96](https://redirect.github.com/sidharthv96)! - feat: Add `getRegisteredDiagramsMetadata` to `mermaid`, which returns all the registered diagram IDs in mermaid ##### Patch Changes - [#&#8203;6738](https://redirect.github.com/mermaid-js/mermaid/pull/6738) [`d90634b`](https://redirect.github.com/mermaid-js/mermaid/commit/d90634bf2b09e586b055729e07e9a1a31b21827c) Thanks [@&#8203;shubham-mermaid](https://redirect.github.com/shubham-mermaid)! - chore: Updated TreeMapDB to use class based approach - [#&#8203;6510](https://redirect.github.com/mermaid-js/mermaid/pull/6510) [`7a38eb7`](https://redirect.github.com/mermaid-js/mermaid/commit/7a38eb715d795cd5c66cb59357d64ec197b432e6) Thanks [@&#8203;sidharthv96](https://redirect.github.com/sidharthv96)! - chore: Move packet diagram out of beta - [#&#8203;6747](https://redirect.github.com/mermaid-js/mermaid/pull/6747) [`3e3ae08`](https://redirect.github.com/mermaid-js/mermaid/commit/3e3ae089305e1c7b9948b9e149eba6854fe7f2d6) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - fix: adjust sequence diagram title positioning to prevent overlap with top border in Safari - [#&#8203;6751](https://redirect.github.com/mermaid-js/mermaid/pull/6751) [`d3e2be3`](https://redirect.github.com/mermaid-js/mermaid/commit/d3e2be35be066adeb7fd502b4a24c223c3b53947) Thanks [@&#8203;darshanr0107](https://redirect.github.com/darshanr0107)! - chore: Update MindmapDB to use class based approach - [#&#8203;6715](https://redirect.github.com/mermaid-js/mermaid/pull/6715) [`637680d`](https://redirect.github.com/mermaid-js/mermaid/commit/637680d4d9e39b4f8cb6f05b4cb261e8f5693ac3) Thanks [@&#8203;Syn3ugar](https://redirect.github.com/Syn3ugar)! - fix(timeline): fix loading `leftMargin` from config The `timeline.leftMargin` config value should now correctly control the size of the left margin, instead of being ignored. - Updated dependencies \[[`7a38eb7`](https://redirect.github.com/mermaid-js/mermaid/commit/7a38eb715d795cd5c66cb59357d64ec197b432e6)]: - [@&#8203;mermaid-js/parser](https://redirect.github.com/mermaid-js/parser)@&#8203;0.6.2 ### [`v11.8.1`](https://redirect.github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.8.1) [Compare Source](https://redirect.github.com/mermaid-js/mermaid/compare/mermaid@11.8.0...mermaid@11.8.1) ##### Patch Changes - Updated dependencies \[[`0da2922`](https://redirect.github.com/mermaid-js/mermaid/commit/0da2922ee7f47959e324ec10d3d21ee70594f557)]: - [@&#8203;mermaid-js/parser](https://redirect.github.com/mermaid-js/parser)@&#8203;0.6.1 </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/open-feature/openfeature.dev).  Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
diff --git a/package.json b/package.json
@@ -47,7 +47,7 @@
     "embla-carousel-react": "^8.6.0",
     "instantsearch-itemsjs-adapter": "^1.1.5",
     "itemsjs": "^2.1.25",
-    "mermaid": "11.8.0",
+    "mermaid": "11.10.0",
     "postcss": "^8.5.4",
     "prism-react-renderer": "2.4.1",
     "prismjs": "1.30.0",
diff --git a/yarn.lock b/yarn.lock
@@ -2325,10 +2325,10 @@
   dependencies:
     langium "3.3.1"
 
-"@mermaid-js/parser@^0.6.0":
-  version "0.6.0"
-  resolved "https://registry.yarnpkg.com/@mermaid-js/parser/-/parser-0.6.0.tgz#91ee90eaa4af80bc3d5e85ad6b58e0abdd6c768e"
-  integrity sha512-7DNESgpyZ5WG1SIkrYafVBhWmImtmQuoxOO1lawI3gQYWxBX3v1FW3IyuuRfKJAO06XrZR71W0Kif5VEGGd4VA==
+"@mermaid-js/parser@^0.6.2":
+  version "0.6.2"
+  resolved "https://registry.yarnpkg.com/@mermaid-js/parser/-/parser-0.6.2.tgz#6d505a33acb52ddeb592c596b14f9d92a30396a9"
+  integrity sha512-+PO02uGF6L6Cs0Bw8RpGhikVvMWEysfAyl27qTlroUB8jSWr1lL0Sf6zi78ZxlSnmgSY2AMMKVgghnN9jTtwkQ==
   dependencies:
     langium "3.3.1"
 
@@ -8007,7 +8007,7 @@ katex@^0.16.0:
   dependencies:
     commander "^8.3.0"
 
-katex@^0.16.9:
+katex@^0.16.22, katex@^0.16.9:
   version "0.16.22"
   resolved "https://registry.yarnpkg.com/katex/-/katex-0.16.22.tgz#d2b3d66464b1e6d69e6463b28a86ced5a02c5ccd"
   integrity sha512-XCHRdUw4lf3SKBaJe4EvgqIuWwkPSo9XoeO8GjQW94Bp7TWv9hNhzZjZ+OH9yf1UmLygb7DIT5GSFQiyt16zYg==
@@ -8326,6 +8326,11 @@ marked@^15.0.7:
   resolved "https://registry.yarnpkg.com/marked/-/marked-15.0.12.tgz#30722c7346e12d0a2d0207ab9b0c4f0102d86c4e"
   integrity sha512-8dD6FusOQSrpv9Z1rdNMdlSgQOIP880DHqnohobOmYLElGEqAL/JvxvuxZO16r4HtjTlfPRDC1hbvxC9dPN2nA==
 
+marked@^16.0.0:
+  version "16.2.1"
+  resolved "https://registry.yarnpkg.com/marked/-/marked-16.2.1.tgz#f4b82ffa8e6201bafebc59249492b88b2dcc949f"
+  integrity sha512-r3UrXED9lMlHF97jJByry90cwrZBBvZmjG1L68oYfuPMW+uDTnuMbyJDymCWwbTE+f+3LhpNDKfpR3a3saFyjA==
+
 math-intrinsics@^1.1.0:
   version "1.1.0"
   resolved "https://registry.yarnpkg.com/math-intrinsics/-/math-intrinsics-1.1.0.tgz#a0dd74be81e2aa5c2f27e65ce283605ee4e2b7f9"
@@ -8591,14 +8596,14 @@ merge2@^1.3.0, merge2@^1.4.1:
   resolved "https://registry.yarnpkg.com/merge2/-/merge2-1.4.1.tgz#4368892f885e907455a6fd7dc55c0c9d404990ae"
   integrity sha512-8q7VEgMJW4J8tcfVPy8g09NcQwZdbwFEqhe/WZkoIzjn/3TGDwtOCYtXGxA3O8tPzpczCCDgv+P2P5y00ZJOOg==
 
-mermaid@11.8.0:
-  version "11.8.0"
-  resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-11.8.0.tgz#d075d48fc4038daf8091b39d590175ddece70e46"
-  integrity sha512-uAZUwnBiqREZcUrFw3G5iQ5Pj3hTYUP95EZc3ec/nGBzHddJZydzYGE09tGZDBS1VoSoDn0symZ85FmypSTo5g==
+mermaid@11.10.0:
+  version "11.10.0"
+  resolved "https://registry.yarnpkg.com/mermaid/-/mermaid-11.10.0.tgz#4949f98d08cfdc4cda429372ed2f843a64c99946"
+  integrity sha512-oQsFzPBy9xlpnGxUqLbVY8pvknLlsNIJ0NWwi8SUJjhbP1IT0E0o1lfhU4iYV3ubpy+xkzkaOyDUQMn06vQElQ==
   dependencies:
     "@braintree/sanitize-url" "^7.0.4"
     "@iconify/utils" "^2.1.33"
-    "@mermaid-js/parser" "^0.6.0"
+    "@mermaid-js/parser" "^0.6.2"
     "@types/d3" "^7.4.3"
     cytoscape "^3.29.3"
     cytoscape-cose-bilkent "^4.1.0"
@@ -8608,10 +8613,10 @@ mermaid@11.8.0:
     dagre-d3-es "7.0.11"
     dayjs "^1.11.13"
     dompurify "^3.2.5"
-    katex "^0.16.9"
+    katex "^0.16.22"
     khroma "^2.1.0"
     lodash-es "^4.17.21"
-    marked "^15.0.7"
+    marked "^16.0.0"
     roughjs "^4.6.6"
     stylis "^4.3.6"
     ts-dedent "^2.2.0"
