[Snyk] Upgrade mermaid from 10.3.0 to 10.9.3 #269
Conversation
Snyk has created this PR to upgrade mermaid from 10.3.0 to 10.9.3. See this package in npm: mermaid See this project in Snyk: https://app.snyk.io/org/sammytezzy/project/a88f4f5f-7e6f-4196-ac10-822626b4c9f7?utm_source=github&utm_medium=referral&page=upgrade-pr
|
|
|
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
Reviewer's Guide by SourceryThis PR upgrades the mermaid dependency from version 10.3.0 to 10.9.3 to address several security vulnerabilities in the DOMPurify dependency. The upgrade includes 20 versions worth of changes and fixes three security issues: a high-severity Prototype Pollution vulnerability and two medium-severity vulnerabilities (Template Injection and Cross-site Scripting). No diagrams generated as the changes look simple and do not need a visual representation. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
We have skipped reviewing this pull request. Here's why:
- It seems to have been created by a bot ('[Snyk]' found in title). We assume it knows what it's doing!
- We don't review packaging changes - Let us know if you'd like us to change this.
Snyk has created this PR to upgrade mermaid from 10.3.0 to 10.9.3.
ℹ️ Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
The recommended version is 20 versions ahead of your current version.
The recommended version was released on 2 months ago.
Issues fixed by the recommended upgrade:
SNYK-JS-DOMPURIFY-7984421
SNYK-JS-DOMPURIFY-6474511
SNYK-JS-DOMPURIFY-8184974
Release notes
Package name: mermaid
-
10.9.3 - 2024-10-22
- GHSA-mmhx-hmjr-r674
- GHSA-64fm-8hw2-v72w
- GHSA-cvr6-37gx-v8wc
- GHSA-f98w-7cxr-ff2h
- GHSA-3wc5-fcw2-2329
- Updates the bundled version of KaTeX to 0.16.11 (2bedd0e)
- Updates the bundled version of DOMPurify to 3.1.6 (92a07ff)
-
10.9.2 - 2024-10-02
- #5914 402abdf [10] fix: ban version v3.1.7 of DOMPurify
-
10.9.1 - 2024-05-14
-
10.9.0 - 2024-03-05
-
10.9.0-rc.2 - 2024-02-29
-
10.9.0-rc.1 - 2024-02-27
-
10.8.0 - 2024-02-02
-
10.7.0 - 2024-01-15
-
10.6.2-rc.3 - 2024-01-11
-
10.6.2-rc.2 - 2023-12-04
-
10.6.2-rc.1 - 2023-11-24
-
10.6.1 - 2023-11-06
-
10.6.0 - 2023-10-25
-
10.5.1 - 2023-10-20
-
10.5.0 - 2023-10-02
-
10.5.0-rc.3 - 2023-10-02
-
10.5.0-rc.1 - 2023-09-14
-
10.5.0-alpha.1 - 2023-09-07
-
10.4.0 - 2023-08-25
-
10.3.1 - 2023-08-11
-
10.3.0 - 2023-07-26
from mermaid GitHub release notesUpdates the bundled version of dependencies in the following files:
dist/mermaid.min.jsdist/mermaid.jsdist/mermaid.esm.mjsdist/mermaid.esm.min.mjsIf you are not using these files (e.g. you are using the default NPM export of
mermaid, e.g.import mermaid from 'mermaid', or you are usingdist/mermaid.core.mjs), this release is identical to v10.9.2.This is to avoid potential security issues in KaTeX and DOMPurify, see:
These dependencies have already been updated in v11.0.0.
Changelog
Chore
Full Changelog: v10.9.2...v10.9.3
This release back-ports #5914 to the v10 release line to fix #5904 (an incompatibility between mermaid and DOMPurify v3.1.7)
Patch Changes
Full Changelog: v10.9.1...v10.9.2
Important
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:
Summary by Sourcery
Build: