chore(deps): bump mermaid from 11.9.0 to 11.10.0 in /docs #5957
Conversation
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.9.0 to 11.10.0. - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.9.0...mermaid@11.10.0) --- updated-dependencies: - dependency-name: mermaid dependency-version: 11.10.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
WalkthroughBumps the Mermaid dependency version in docs/package.json from ^11.9.0 to ^11.10.0. No other files or dependencies changed. No public/exported declarations affected. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Possibly related PRs
Suggested reviewers
✨ Finishing Touches🧪 Generate unit tests
🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR/Issue comments)Type Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (2)
docs/package.json (2)
26-26: Consolidate Mermaid integrations
A quick scan confirms you’re loading both themdx-mermaidMDX plugin and the built-in@docusaurus/theme-mermaidtheme in your docs site. If you don’t rely on any mdx-mermaid–specific features, you can simplify your setup and reduce bundle size by removingmdx-mermaid.Locations to update:
- docs/package.json
• Remove the"mdx-mermaid": "^2.0.3"dependency- docs/docusaurus.config.js
• Delete theconst mermaidPlugin = require("mdx-mermaid");line
• Remove the["mdx-mermaid", …]entry from themdx.pluginsarrayAfter that, you can rely solely on:
"@docusaurus/theme-mermaid": "^3.8.1", "mermaid": "^11.10.0"and drop
mdx-mermaidfrom your build.
50-52: DOMPurify resolution correctly satisfies Mermaid 11.10.0 but still pins to 3.2.6
As verified indocs/yarn.lock, Mermaid 11.10.0 depends ondompurify@^3.2.5, which under our"resolutions": { "dompurify": "3.2.6" }is resolved to 3.2.6—so you’re not reverting any of Mermaid’s sanitization fixes. However, this resolution will block any later patch releases of DOMPurify beyond 3.2.6.• If DOMPurify ≥3.2.7 or newer include further security/bug fixes, consider bumping the resolution to the latest version.
• Or remove the resolution entirely to allow automatic patch‐level updates per the semver range.Let me know if you’d like a follow-up PR to bump or remove this pin.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
💡 Knowledge Base configuration:
- MCP integration is disabled by default for public repositories
- Jira integration is disabled by default for public repositories
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
⛔ Files ignored due to path filters (1)
docs/yarn.lockis excluded by!**/yarn.lock,!**/*.lock
📒 Files selected for processing (1)
docs/package.json(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (2)
- GitHub Check: Check
- GitHub Check: Deploy to Cloudflare Pages
🔇 Additional comments (2)
docs/package.json (2)
26-26: LGTM: Safe minor bump to mermaid 11.10.0 (security + fixes).Minor version update with upstream fixes (including sanitization/CVE patch) looks good for docs. No breaking changes expected for typical Docusaurus usage.
26-26: ✅ No direct CommonJS mermaid imports detected
I scanned the JS/TS files and found norequire('mermaid')calls or manualmermaid.*usages. The only Mermaid integrations are indocs/docusaurus.config.jsvia:
require("mdx-mermaid")remark plugin- the built-in
@docusaurus/theme-mermaidpluginBoth handle the ESM-only v11 API under the hood, so there’s no runtime breakage.
Bumps mermaid from 11.9.0 to 11.10.0.
Release notes
Sourced from mermaid's releases.
... (truncated)
Commits
96778f7Merge pull request #6880 from mermaid-js/changeset-release/masterd4c058bVersion Packagesb638a0atemp: Remove peerDeps from examplesfd9aa36chore: Update peerDependencies for examples46a9f1btemp: Disable cspell check as it's blocking release83c6224Merge pull request #6878 from mermaid-js/developd8161b1fix: move fourcube to contributor8223141chore: add fourcube to cspell99f98a6Merge pull request #6877 from mermaid-js/update-timingsef28f54chore: update E2E timingsDependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.
Summary by CodeRabbit