chore(deps): mermaid ^ 11.17.2

[floatpanebot]

What?

This PR contains the following updates:

Package	Change	Age	Confidence
mermaid	11.16.0 → 11.17.2

---

Release Notes

mermaid-js/mermaid (mermaid)

v11.17.2

Compare Source

Patch Changes

• #​8125 178d7c7 Thanks @​knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

v11.17.1

Compare Source

Patch Changes

• #​8092 31ce60a Thanks @​pbrolin47! - fix(c4): wrap element labels to c4.width again

  C4 element labels (System, Container, Component, Person and their _Ext variants) stopped wrapping in 11.17.0, so long descriptions rendered on one unbroken line and the shape grew sideways well past the configured c4.width. The unified-shapes label helper gated wrapping on the root-level wrap option, which has no schema default and is therefore undefined; it now gates on c4.wrap (default true), which is what the legacy renderer used.

• #​8088 c66200b Thanks @​ashishjain0512! - fix: neo-look arrowheads and crow's-foot markers no longer fall back to default theme colours/stroke widths on the first render with layout: elk. State diagram arrowheads stayed dark on dark themes, and ER / requirement markers were drawn at the default stroke width, because markers were created from the layout package's own bundled copy of mermaid, whose config had not been initialized yet.

• #​8079 281cd7b Thanks @​ashishjain0512! - fix(class): class diagram relation markers (composition, aggregation, extension, dependency, lollipop) no longer scale with the edge stroke width, so they stay outside the class box boundary in themes that set strokeWidth: 2 (redux, redux-dark, redux-color, redux-dark-color, neo, neo-dark) with the default classic look.

v11.17.0

Compare Source

Minor Changes

• #​7842 3670b4e Thanks @​filipsajdak! - feat(c4): render C4 elements through the unified shape system, using the new person shape

• #​7812 cdfc0ea Thanks @​knsv-bot! - feat(class): route classDiagram to the unified (v2) renderer by default

  Set class: { defaultRenderer: 'dagre-d3' } in the config to restore the legacy renderer.

• #​7785 c45cde9 Thanks @​knsv-bot! - feat(flowchart): add collapsible flowchart subgraphs via subgraphId@{ view: collapsed }

• #​7828 8eb3afc Thanks @​knsv-bot! - feat(elk): add elk.keepEntryNodeOnTop config option to keep a recursive flow's entry node on top

• #​7803 74e44eb Thanks @​knsv-bot! - feat(elk): add elk.nodePlacementAlignment config option

• #​7792 ea55b31 Thanks @​RodrigojndSantos! - feat(er): add subgraph support to ER diagrams.

• #​7970 a2c0fb6 Thanks @​filipsajdak! - feat(flowchart): add folder, bucket, console (terminal window) and browser shapes

• #​7842 ae3e115 Thanks @​filipsajdak! - feat(flowchart): add person shape (circular head above a rounded body), usable in flowcharts via A@{ shape: person }

• #​7724 0fd7a9f Thanks @​xdumaine! - feat(xyChart): add legends for named line and bar series

Patch Changes

• #​7847 215fe89 Thanks @​filipsajdak! - fix(c4): named attributes such as $tags, $link and $sprite are no longer clobbered to undefined when they arrive in an earlier positional slot of Person/System/Container/Component/Boundary/Rel statements.

• #​7871 8d874c4 Thanks @​knsv-bot! - fix(flowchart): stop dagre layout from spamming warn-level logs on every node/edge/cluster

• #​8071 b3d1f63 Thanks @​pbrolin47! - fix(block): sibling blocks overlapping in block diagrams when one has a label wider than 200px

• #​7870 71b8843 Thanks @​knsv-bot! - fix: a RangeError: Invalid array length crash when rendering certain edges.

• #​7924 9cbef5d Thanks @​nightt5879! - fix(treeView): icons disappearing after strict security sanitization.

• #​7850 a34cbf0 Thanks @​aloisklink! - fix(block): allow classdefs to update text color

• #​7937 f9cbe1e Thanks @​filipsajdak! - fix(dagre): let a diagram's own nodeSpacing/rankSpacing take effect in the unified dagre layout

• #​8005 90eeece Thanks @​pbrolin47! - fix(flowchart): reverts the behavior change from #​7672 (fix/4648-directions), since arrows between subgraphs are broken

• #​7951 afa2f80 Thanks @​aloisklink! - perf: use fastdom to batch DOM measurements (up to 25% speedup)

• Updated dependencies [e848423]:

  • @​mermaid-js/parser@​1.2.1

v11.16.1

Compare Source

Patch Changes

• #​8022 12d472c Thanks @​aloisklink! - fix: handle CSS sibling combinators in compileCSS

• #​8022 2cd6dcf Thanks @​aloisklink! - fix: increase protections against prototype pollution

  User-controlled input already has protections against prototype pollution.

  Fixes: GHSA-c4c3-pg64-4m4v

• #​8022 99af3fc Thanks @​aloisklink! - fix(architecture): use Maps and Sets to store groups/services

  Services are now rendered in the order they are defined and more service IDs
  are now supported.

• #​8022 2cd6dcf Thanks @​aloisklink! - deprecate: Deprecate the mermaidAPI.setConfig() function

  Calling this function has no observable effect, as the next time a
  render() or parse() is called, the currentConfig is cleared.

• #​8022 630aa7e Thanks @​aloisklink! - fix(xychart): support zero-width x-axis ranges

• #​8022 59b22fa Thanks @​aloisklink! - fix(radar): limit number of ticks to 32

  Setting a ticks value higher than this would only show 32 ticks.

Why?

Automated dependency update via Renovate.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[floatpanebot]

❌ Security failed

Commit: c45fd8b · run logs

Failed jobs:

• govulncheck — Run govulncheck ./... and update vulnerable deps.

Failure details

Build errors:

• 2026-08-25T12:47:52.3680829Z ##[error] #1: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls url.URL.Parse
• 2026-08-25T12:47:52.3696649Z ##[error] #1: fetcher/fetcher.go:421: fetcher.connectWithOptions calls imapclient.DialStartTLS, which eventually calls tls.Conn.Handshake
• 2026-08-25T12:47:52.3699761Z ##[error] #2: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls tls.Conn.HandshakeContext
• 2026-08-25T12:47:52.3702367Z ##[error] #3: backend/jmap/jmap.go:362: jmap.Provider.FetchAttachment calls io.ReadAll, which calls tls.Conn.Read
• 2026-08-25T12:47:52.3704530Z ##[error] #4: main.go:4411: matcha.main calls fmt.Fprintf, which calls tls.Conn.Write
• 2026-08-25T12:47:52.3680814Z ##[error] #1: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls url.URL.Parse
• 2026-08-25T12:47:52.3696628Z ##[error] #1: fetcher/fetcher.go:421: fetcher.connectWithOptions calls imapclient.DialStartTLS, which eventually calls tls.Conn.Handshake
• 2026-08-25T12:47:52.3699754Z ##[error] #2: spellcheck/download.go:40: spellcheck.Download calls http.Client.Do, which eventually calls tls.Conn.HandshakeContext