Update packages to fix vulnerabilities

[CalebUsadi]

📑 Summary

Update parse-url and d3 packages to fix security vulnerabilities.

Resolves #3705

[huineng]

Thanks, this is an important fix, if this can be merged, that would be great

[sidharthv96]

@CalebUsadi can you resolve the conflicts?

[sidharthv96]

LGTM, as long as the tests pass.

[aloisklink]

This won't fix the npm audit security warnings for people that npm install mermaid, e.g. #3705 will NOT be fixed.

To fix that, we'd need to replace dagre-d3 with a version that has updated dependencies (maybe https://www.npmjs.com/package/dagre-d3-es ?). This is because downstream users won't see the pnpm.overrides bit in our package.json, or even if they do, npm/yarn will ignore it.

However, this PR should still fix bundle vulnerabilities.

[sidharthv96]

Seems like dagre-d3-esm doesn't expose the functions we need directly. Although it seems to be there in their code.

[0] 'intersect' is not exported by 'node_modules/.pnpm/dagre-d3-es@7.0.1/node_modules/dagre-d3-es/src/index.js'

Raised tbo47/dagre-es#5

[aloisklink]

Seems like dagre-d3-esm doesn't expose the functions we need directly.

I've just tested it, and it does export all the functions we need, although the import paths are a bit different. See #3809 for a working version. We have to import each function individually, which is actually better, since then ESM/tree-shaking can occur to reduce our bundle sizes.

E.g.:

// before
import dagreD3 from 'dagre-d3';
dagreD3.intersect.polygon(node, points, point);

// after
import { intersectPolygon } from 'dagre-d3-es/src/dagre-js/intersect/intersect-polygon';
intersectPolygon(node, points, point);

[tbo47]

Seems like dagre-d3-esm doesn't expose the functions we need directly.

I've just tested it, and it does export all the functions we need, although the import paths are a bit different. See #3809 for a working version. We have to import each function individually, which is actually better, since then ESM/tree-shaking can occur to reduce our bundle sizes.

E.g.:

// before
import dagreD3 from 'dagre-d3';
dagreD3.intersect.polygon(node, points, point);

// after
import { intersectPolygon } from 'dagre-d3-es/src/dagre-js/intersect/intersect-polygon';
intersectPolygon(node, points, point);

I think it will solve your problem https://github.com/tbo47/dagre-es/pull/6/files

Do you mind testing by manually copy and paste the modifications in my PR into your local node_modules/dagre-d3-es/src/?

If it solves your problem I will merge and release a new version.

This should work:

import dagreD3 from 'dagre-d3-es';
dagreD3.intersect.polygon(node, points, point);