fix(deps): clear the two advisories blocking the release - #31
Merged
Conversation
`npm audit` at the release gate has failed since the v0.4.14 tag, so no tag can ship until both are cleared: - mermaid — five advisories covering 11.0.0-alpha.1 through 11.16.0 (prototype pollution in the config APIs and in Architecture diagrams, CSS injection into siblings of the diagram, DoS in XY charts and radar diagrams). This one SHIPS in the app, and the app renders untrusted diagram source, so it is the one that matters. 11.16.1 is the fix — a patch bump, no API change. - js-yaml 4.3.0 — quadratic CPU in !!omap resolution (CVE-2026-59870). Dev-only: it reaches the tree through electron-builder and @intlify/eslint-plugin-vue-i18n and never ships. 4.3.1 is the fix in the 4.x line, so nothing has to force a major into someone else's tool — which docs/standards.md rules out anyway. Both are semver-compatible, so `make audit-fix` (container npm, not --force) resolved them and the lock stays Linux-complete. `npm audit` now reports 0 vulnerabilities. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npm auditat the release gate (release.yml) has failed since the v0.4.14 tag, which is why v0.4.14 never shipped andpackage.jsonon main is still at0.4.13. No tag can ship until both are cleared.mermaid^11.16.0^11.16.1js-yaml4.3.04.3.1mermaid — the one that matters
Five advisories cover
11.0.0-alpha.1 … 11.16.0: prototype pollution in the configuration APIs and in Architecture diagrams, CSS injection applying to siblings of the diagram, and DoS in XY charts and radar diagrams. This is a production dependency and the app renders diagram source it did not write, so this is a real exposure rather than a build-machine one.11.16.1is the fix — a patch bump, no API change.js-yaml — dev only
Quadratic CPU in
!!omapresolution (CVE-2026-59870). It reaches the tree only throughelectron-builderand@intlify/eslint-plugin-vue-i18n; nothing we import reaches it and it never ships.4.3.1is the backported fix in the 4.x line, so no major is forced into someone else's tool — whichdocs/standards.mdrules out anyway.How
Both are semver-compatible, so
make audit-fix(container npm, never--force) resolved them and the lock stays Linux-complete.--forcewas not used: on this tree it reaches electron and electron-builder.Verification
npm audit— 0 vulnerabilities (was 1 high, 1 moderate)npm run check— green. 2632 passed | 2 skipped; coverage 95.09 st / 88.03 br / 95.68 fn / 96.09 limake rebuild+make e2e— the full suite against the bumped mermaid, since it is what renders every diagram🤖 Generated with Claude Code