Skip to content

Update dependency mermaid to v11.16.1 [SECURITY] (main) - #543

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-npm-mermaid-vulnerability
Open

Update dependency mermaid to v11.16.1 [SECURITY] (main)#543
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/main-npm-mermaid-vulnerability

Conversation

@renovate

@renovate renovate Bot commented May 11, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
mermaid 11.12.1 → 11.16.1 age adoption passing confidence

Mermaid: Improper sanitization of classDef in state diagrams leads to HTML injection

CVE-2026-41149 / GHSA-ghcm-xqfw-q4vr

More information

Details

Impact

Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although <script> tags are removed, preventing XSS.

Proof-of-concept
stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss
Patches
Workarounds

If you can not update to a patched version, setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Credits

Thanks to @​zsxsoft from @​KeenSecurityLab for reporting this vulnerability.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid: Improper sanitization of classDefs in diagrams leads to CSS injection

CVE-2026-41148 / GHSA-xcj9-5m2h-648r

More information

Details

Details

The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures classDef values with an unrestricted regex:

// packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83
<CLASSDEFID>[^\n]*   { this.popState(); return 'CLASSDEF_STYLEOPTS' }

The value passes unsanitized through addStyleClass() -> createCssStyles() -> style.innerHTML (mermaidAPI.ts:418). A } in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page.

PoC
stateDiagram-v2 
      classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")}

Live demo:
https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU

Patches

This has been patched in:

Workarounds

Setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Impact

Enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration via CSS :has() selectors.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

CVE-2026-41150 / GHSA-6m6c-36f7-fhxh

More information

Details

Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.

Example:

gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d

mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram).

Patches

This has been patched in:

Workarounds

There are no workarounds available without updating to a newer version of mermaid.

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid: Improper sanitization of configuration leads to CSS injection

CVE-2026-41159 / GHSA-87f9-hvmw-gh4p

More information

Details

Impact

Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options.

Live demo: mermaid.live

Example code:

%%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%%
flowchart LR
    A --> B

The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level.

This allows page defacement and DOM attribute exfiltration via CSS :has() selectors.

Patches
Workarounds

If you can't upgrade mermaid, you can set the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables.

Setting "securityLevel": "sandbox" will also prevent this.

Credits

Reported by @​zsxsoft on behalf of @​KeenSecurityLab

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid radar diagrams are vulnerable to DoS

CVE-2026-71439 / GHSA-rhh3-jpg6-66xh

More information

Details

Impact

Mermaid radar diagrams allow arbitrary large values for ticks, which can cause high CPU usage, freezing the webpage/JavaScript process for long periods of time, until the process is eventually killed due to OOM/running out of memory.

Proof-of-concept
radar-beta
  axis a, b
  curve c {1, 1}
  ticks 1000000000
Patches

Has the problem been patched? What versions should users upgrade to?

This problem has been patched by mermaid-js/mermaid@59b22fa, which was released in Mermaid v11.16.1

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There are no known workarounds without updating to a patched version of mermaid.

References

Are there any links users can visit to find out more?

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid Architecture diagrams are vulnerable to prototype pollution

CVE-2026-71437 / GHSA-3rrr-jr9j-h3q3

More information

Details

Rendering an untrusted architecture-beta diagram lets the diagram author write an arbitrary property with the value horizontal or vertical onto Object.prototype. A group id of __proto__ is accepted as a valid parent.

Impact

Any code in the same realm that reads a property of that name from an arbitrary object, or enumerates an object with bare for...in, observes the injected value (which can only be the string horizontal or vertical.

This may mean corrupted option/config defaults, bypassed truthiness checks, causing denial of service or logic corruption in the embedding application.

Because the injected value cannot be an object or function, this is not directly exploitable for remote code execution.

PoC
architecture-beta
      group mermaidPrototypePollutionMarker(cloud)[Marker]
      service a(server)[A] in __proto__
      service b(server)[B] in mermaidPrototypePollutionMarker
      a:R -- L:b

The vulnerable write was introduced in commit cb0a4703bdf01d47508bde1c08aa9a980d70bc20 and first shipped in mermaid@11.5.0. The lines are unchanged in every release since.

Patches

This has been patched by mermaid-js/mermaid@99af3fc, released in Mermaid v11.16.1

Workarounds

There are no known workarounds. Please update to a patched version.

References

Are there any links users can visit to find out more?

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid XY Charts are vulnerable to an infinite loop DoS

CVE-2026-71436 / GHSA-2v8p-3f2j-5mp7

More information

Details

Impact

Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.

As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.

Proof-of-concept
xychart
  x-axis 1 --> 1
  line [1, 2]
Patches

This has been patched in mermaid-js/mermaid@630aa7e and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in Mermaid v10.9.8

Workarounds

There are no known workarounds. Please update to the latest version or apply the patch.

References

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid configuration APIs allow prototype pollution

CVE-2026-71438 / GHSA-c4c3-pg64-4m4v

More information

Details

Summary

Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.

Because these APIs are intended to receive trusted configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as low. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.

User-controlled configuration (e.g. configuration in diagram code using %%{init: {}}%% or YAML frontmatter) are already protected from prototype pollution.

Patches

This has been patched in mermaid-js/mermaid@2cd6dcf and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in Mermaid v10.9.8

Impact

Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.

Workarounds

Don't pass user-controlled data to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions. Instead, users can use %%{init: {}}%% or YAML frontmatter in diagrams.

Reporters

Severity

  • CVSS Score: 2.4 / 10 (Low)
  • Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mermaid allows CSS injection applying to sibling elements of the diagram

CVE-2026-50159 / GHSA-6x64-9x62-f2gx

More information

Details

Summary

Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram <svg>.

Most users of mermaid would not be affected by this, as mermaid adds its <svg> as an only child of it's parent element. However, you may be affected if you manually insert the <svg> (or other elements) into the DOM yourself.

Details

Mermaid namespaces CSS through with a middleware intended to scope all rules to the diagram's SVG element. CSS nesting expands & ~ * { ... } to #svgId ~ *, which selects all sibling elements following the SVG in the DOM, outside the diagram boundary.

Impact

An attacker able to supply diagram source to a page (e.g., user-generated content rendered by Mermaid) could inject CSS rules affecting sibling elements to the diagram <svg> on the host page. This can be used for UI redressing, hiding content, conditional CSS-based probing, or phishing-style visual manipulation.

JavaScript execution is not possible via this vector.

Patches

This has been patched in mermaid-js/mermaid@12d472c and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in 7e83f1533318b307764d961906a73377266f4c5e and was released in Mermaid v10.9.8

Workarounds

If you are inserting the <svg> into the DOM yourself, you can wrap it in an element with no other children, e.g. <div><svg>...</svg></div> or element.innerHTML = svg. Alternatively, you can use mermaid.run() or mermaid.initialize() which will do this for you.

Setting "securityLevel": "sandbox" will also prevent this, or setting the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables.

To test, you can try using a themeCSS with & + * { /* my CSS here */} and see if it's applied outside of your mermaid <svg>.

---
config:
  themeCSS: |-
    & + * { background:red !important; width:100vw !important; height:100vh !important; position:fixed !important; inset:0 !important; }
---
info
References

Severity

  • CVSS Score: 5.3 / 10 (Medium)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

mermaid-js/mermaid (mermaid)

v11.16.1

Compare Source

Patch Changes

v11.16.0

Compare Source

Minor Changes

  • #​7535 ea1c48f Thanks @​ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.

  • #​7721 f45cc2c Thanks @​notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams

  • #​7550 f1f4d45 Thanks @​DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots

  • #​7527 b4d0442 Thanks @​notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.

  • #​7793 a6f097d Thanks @​SSDWGG! - feat(er): support optional ER attribute types with a ? suffix

  • #​7772 37f2e36 Thanks @​devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#​6270)

  • #​7708 4e63e9d Thanks @​txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.

  • #​7760 05223be Thanks @​ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice

  • #​7251 216e4e9 Thanks @​ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).

  • #​7774 e5c75e6 Thanks @​ngdaniels! - feat(xychart): enable rotate label on X-axis

  • #​7791 974fa7b Thanks @​knsv-bot! - feat(swimlane): add swimlane as a standalone diagram type with a dedicated layered orthogonal layout algorithm

Patch Changes

v11.15.0

Compare Source

Minor Changes

  • #​7174 0aca217 Thanks @​milesspencer35! - feat(sequence): Add support for decimal start and increment values in the autonumber directive

  • #​7512 8e17492 Thanks @​aruncveli! - feat(flowchart): add datastore shape

    In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with A@{ shape: datastore, label: "Datastore" }.

  • #​6440 9ad8dde Thanks @​yordis, @​lgazo! - feat: add Event Modeling diagram

  • #​7707 27db774 Thanks @​txmxthy! - feat(architecture): expose four fcose layout knobs for architecture-beta diagrams (nodeSeparation, idealEdgeLengthMultiplier, edgeElasticity, numIter) so authors can tune layout density and spread overlapping siblings without changing diagram source

  • #​7604 bf9502f Thanks @​M-a-c! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting

    If you have namespaces in class diagrams that use .s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set class.hierarchicalNamespaces=false in your mermaid config:

    config:
  class:
    hierarchicalNamespaces: false

  • #​7272 88cdd3d Thanks @​xinbenlv! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors

Patch Changes

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@github-actions

github-actions Bot commented May 11, 2026

Copy link
Copy Markdown
Contributor

🚀 Preview is available at https://ee5e1837.enterprise-contract.pages.dev

@renovate
renovate Bot force-pushed the renovate/main-npm-mermaid-vulnerability branch from 3ad2de5 to 9bacecf Compare May 18, 2026 19:03
@github-actions

github-actions Bot commented May 18, 2026

Copy link
Copy Markdown
Contributor

🚀 Preview is available at https://33417921.enterprise-contract.pages.dev

@renovate
renovate Bot force-pushed the renovate/main-npm-mermaid-vulnerability branch from 9bacecf to b709222 Compare May 28, 2026 19:34
@github-actions

github-actions Bot commented May 28, 2026

Copy link
Copy Markdown
Contributor

🚀 Preview is available at https://60e3554f.enterprise-contract.pages.dev

@renovate
renovate Bot force-pushed the renovate/main-npm-mermaid-vulnerability branch from b709222 to 08bed34 Compare June 11, 2026 20:02
@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

🚀 Preview is available at https://01f02e92.enterprise-contract.pages.dev

@renovate
renovate Bot force-pushed the renovate/main-npm-mermaid-vulnerability branch from 08bed34 to 00d256d Compare July 12, 2026 17:04
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 5:05 PM UTC · Completed 5:16 PM UTC
Commit: 87c4a29 · View workflow run →

@github-actions

github-actions Bot commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

🚀 Preview is available at https://82bad379.enterprise-contract.pages.dev

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 12, 2026 •
edited
Loading

Copy link
Copy Markdown

Looks good to me

Previous run

Review

Verdict: request-changes

Summary

This PR updates the mermaid npm package from 11.12.1 to 11.15.0 in antora/package-lock.json to address CVE-2026-41149 (HTML injection via classDef in state diagrams). The lockfile change itself is mechanically correct — the package.json constraint ^11.10.1 is semver-compatible with 11.15.0, and the transitive dependency updates (including dompurify 3.2.6 → 3.4.12) are legitimate.

However, this PR does not fix the vulnerability it is intended to address. The npm-installed mermaid package is never imported or required by any build-time code. The actual mermaid library served to users is loaded client-side from a CDN at a hardcoded vulnerable version.

Findings

🔴 CDN version pinned to vulnerable mermaid 11.10.1 — security fix is incomplete

File: antora/supplemental-ui/js/mermaid-init.js, line 4
Severity: high

The mermaid library is loaded at runtime from a CDN URL hardcoded to version 11.10.1:

script.src = 'https://cdn.jsdelivr.net/npm/mermaid@11.10.1/dist/mermaid.min.js';

The Asciidoctor extension at antora/extensions/mermaid.js only wraps content in <div class="mermaid"> tags — it does not import or bundle the npm package. No file in the repository contains require('mermaid') or import ... from 'mermaid'. Therefore, the npm-installed mermaid is never used at build time or runtime.

Updating the lockfile from 11.12.1 to 11.15.0 has no effect on the mermaid version actually served to users. The CDN-loaded 11.10.1 remains vulnerable to CVE-2026-41149.

Remediation: Update the CDN URL in antora/supplemental-ui/js/mermaid-init.js line 4 to load mermaid@11.15.0. Alternatively, restructure the build to bundle the npm-installed mermaid instead of loading from CDN.

🟡 securityLevel: 'loose' may weaken mermaid sanitization

File: antora/supplemental-ui/js/mermaid-init.js, line 10
Severity: medium

The mermaid initialization uses securityLevel: 'loose', which disables DOMPurify sanitization within mermaid. CVE-2026-41149 addresses HTML injection via classDef in state diagrams. Even after the mermaid version is updated to 11.15.0, the loose security level may reduce the protection the patch provides. This is a pre-existing configuration concern, not introduced by this PR.

Remediation: Consider changing securityLevel to 'strict' (the default) unless there is a documented need for raw HTML in diagrams.

🔵 npm-installed mermaid is unused — unnecessary dependency

File: antora/package.json, line 28
Severity: low

The mermaid package is listed as a production dependency in package.json and installed during CI, but no build-time code imports or requires it. Mermaid rendering happens entirely client-side via the CDN script. This adds unnecessary CI time and supply chain attack surface.

Remediation: Either remove mermaid from package.json dependencies (if CDN loading is the intended approach), or restructure the build to bundle the npm-installed mermaid.

Reviewed dimensions: correctness, security, intent/coherence, style/conventions, docs-currency. Cross-repo contracts skipped (no exported APIs modified).

fullsend-ai-review[bot]

This comment was marked as outdated.

Sign in to view

@renovate
renovate Bot force-pushed the renovate/main-npm-mermaid-vulnerability branch from 00d256d to 65bc7a9 Compare July 24, 2026 19:46
@fullsend-ai-review

fullsend-ai-review Bot commented Jul 24, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 7:47 PM UTC · Ended 7:53 PM UTC
Commit: 87c4a29 · View workflow run →

@github-actions

github-actions Bot commented Jul 24, 2026

Copy link
Copy Markdown
Contributor

🚀 Preview is available at https://8af3cbce.enterprise-contract.pages.dev

@fullsend-ai-review

fullsend-ai-review Bot commented Jul 24, 2026

Copy link
Copy Markdown

🤖 Finished Review · ❌ Failure · Started 7:47 PM UTC · Completed 7:53 PM UTC
Commit: 87c4a29 · View workflow run →

@renovate renovate Bot changed the title Update dependency mermaid to v11.15.0 [SECURITY] (main) Update dependency mermaid to v11.16.1 [SECURITY] (main) Aug 8, 2026
@renovate
renovate Bot force-pushed the renovate/main-npm-mermaid-vulnerability branch from 65bc7a9 to b915c27 Compare August 8, 2026 04:26
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 8, 2026 •
edited
Loading

Copy link
Copy Markdown

🤖 Review · ❌ Terminated · Started 4:28 AM UTC · Ended 4:41 AM UTC

Commit: 87c4a29 · View workflow run →

@github-actions

github-actions Bot commented Aug 8, 2026

Copy link
Copy Markdown
Contributor

🚀 Preview is available at https://c45be19c.enterprise-contract.pages.dev

@fullsend-ai-review
fullsend-ai-review Bot dismissed their stale review August 8, 2026 04:40

Superseded by updated review

@fullsend-ai-review fullsend-ai-review Bot added the ready-for-merge All reviewers approved — ready to merge label Aug 8, 2026
@fullsend-ai-review

fullsend-ai-review Bot commented Aug 8, 2026

Copy link
Copy Markdown

🤖 Finished Review · ✅ Success · Started 4:28 AM UTC · Completed 4:41 AM UTC

Commit: 87c4a29 · View workflow run →

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

1 more reviewer
@fullsend-ai-review fullsend-ai-review[bot] fullsend-ai-review[bot] approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

main ready-for-merge All reviewers approved — ready to merge renovate size: L

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants