chore(deps): update node dependencies#2014
Merged
ggrossetie merged 1 commit intomainfrom Apr 2, 2026
Merged
Conversation
aab1203 to
ec1cc21
Compare
ec1cc21 to
92444c1
Compare
92444c1 to
9cee884
Compare
3b1eebd to
f7fe89a
Compare
f7fe89a to
2195cfd
Compare
1a682aa to
b80fd5b
Compare
b80fd5b to
a5d70e5
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
18.12.0→18.14.00.27.3→0.27.54.17.23→4.18.111.12.3→11.14.024.14.0→24.14.1Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
bpmn-io/bpmn-js (bpmn-js)
v18.14.0Compare Source
FEAT: prioritize full word matches in search (bpmn-io/diagram-js#1017)FEAT: factor match density into search (bpmn-io/diagram-js#1017)CHORE: prioritize later search matches slightly lower (bpmn-io/diagram-js#1017)DEPS: update todiagram-js@15.11.0DEPS: update toids@3.0.3v18.13.2Compare Source
FIX: disable grouping in popup menu during search (bpmn-io/diagram-js#1014)FIX: correct handling of annotations during sub-process collapse/expand, copy/paste, and remove actions (#2388)FIX: allow undo of pasted sub-process (#2388, #2269)DEPS: update todiagram-js@15.10.0v18.13.1Compare Source
FIX: correct sequence flow layout for corner boundary events whose target is strictly axis-aligned (#2270)v18.13.0Compare Source
FEAT: allow to create child elements from the context pad (#2391)v18.12.1Compare Source
FIX: correctly replace non-interrupting event with an interrupting one (#2313)evanw/esbuild (esbuild)
v0.27.5Compare Source
Fix for an async generator edge case (#4401, #4417)
Support for transforming async generators into the equivalent state machine was added in version 0.19.0. However, the generated state machine didn't work correctly when polling async generators concurrently, such as in the following code:
Previously esbuild's output of the above code behaved incorrectly when async generators were transformed (such as with
--supported:async-generator=false). The transformation should be fixed starting with this release.This fix was contributed by @2767mr.
Fix a regression when
metafileis enabled (#4420, #4418)This release fixes a regression introduced by the previous release. When
metafile: truewas enabled in esbuild's JavaScript API, builds with build errors were incorrectly throwing an error about an empty JSON string instead of an object containing the build errors.Use define semantics for TypeScript parameter properties (#4421)
Parameter properties are a TypeScript-specific code generation feature that converts constructor parameters into class fields when they are prefixed by certain keywords. When
"useDefineForClassFields": trueis present intsconfig.json, the TypeScript compiler automatically generates class field declarations for parameter properties. Previously esbuild didn't do this, but esbuild will now do this starting with this release:Allow
es2025as a target intsconfig.json(#4432)TypeScript recently added
es2025as a compilation target, so esbuild now supports this in thetargetfield oftsconfig.jsonfiles, such as in the following configuration file:{ "compilerOptions": { "target": "ES2025" } }As a reminder, the only thing that esbuild uses this field for is determining whether or not to use legacy TypeScript behavior for class fields. You can read more in the documentation.
v0.27.4Compare Source
Fix a regression with CSS media queries (#4395, #4405, #4406)
Version 0.25.11 of esbuild introduced support for parsing media queries. This unintentionally introduced a regression with printing media queries that use the
<media-type> and <media-condition-without-or>grammar. Specifically, esbuild was failing to wrap anorclause with parentheses when inside<media-condition-without-or>. This release fixes the regression.Here is an example:
Fix an edge case with the
injectfeature (#4407)This release fixes an edge case where esbuild's
injectfeature could not be used with arbitrary module namespace names exported using anexport {} fromstatement with bundling disabled and a target environment where arbitrary module namespace names is unsupported.With the fix, the following
injectfile:Can now always be rewritten as this without esbuild sometimes incorrectly generating an error:
Attempt to improve API handling of huge metafiles (#4329, #4415)
This release contains a few changes that attempt to improve the behavior of esbuild's JavaScript API with huge metafiles (esbuild's name for the build metadata, formatted as a JSON object). The JavaScript API is designed to return the metafile JSON as a JavaScript object in memory, which makes it easy to access from within a JavaScript-based plugin. Multiple people have encountered issues where this API breaks down with a pathologically-large metafile.
The primary issue is that V8 has an implementation-specific maximum string length, so using the
JSON.parseAPI with large enough strings is impossible. This release will now attempt to use a fallback JavaScript-based JSON parser that operates directly on the UTF8-encoded JSON bytes instead of usingJSON.parsewhen the JSON metafile is too big to fit in a JavaScript string. The new fallback path has not yet been heavily-tested. The metafile will also now be generated with whitespace removed if the bundle is significantly large, which will reduce the size of the metafile JSON slightly.However, hitting this case is potentially a sign that something else is wrong. Ideally you wouldn't be building something so enormous that the build metadata can't even fit inside a JavaScript string. You may want to consider optimizing your project, or breaking up your project into multiple parts that are built independently. Another option could potentially be to use esbuild's command-line API instead of its JavaScript API, which is more efficient (although of course then you can't use JavaScript plugins, so it may not be an option).
lodash/lodash (lodash)
v4.18.1Compare Source
Bugs
Fixes a
ReferenceErrorissue inlodashlodash-eslodash-amdandlodash.templatewhen using thetemplateandfromPairsfunctions from the modular builds. See #6167 (comment)These defects were related to how lodash distributions are built from the main branch using https://github.com/lodash-archive/lodash-cli. When internal dependencies change inside lodash functions, equivalent updates need to be made to a mapping in the lodash-cli. (hey, it was ahead of its time once upon a time!). We know this, but we missed it in the last release. It's the kind of thing that passes in CI, but fails bc the build is not the same thing you tested.
There is no diff on main for this, but you can see the diffs for each of the npm packages on their respective branches:
lodash: lodash/lodash@4.18.0-npm...4.18.1-npmlodash-es: lodash/lodash@4.18.0-es...4.18.1-eslodash-amd: lodash/lodash@4.18.0-amd...4.18.1-amdlodash.templatelodash/lodash@4.18.0-npm-packages...4.18.1-npm-packagesv4.18.0Compare Source
v4.18.0
Full Changelog: lodash/lodash@4.17.23...4.18.0
Security
_.unset/_.omit: Fixed prototype pollution viaconstructor/prototypepath traversal (GHSA-f23m-r3pf-42rh, fe8d32e). Previously, array-wrapped path segments and primitive roots could bypass the existing guards, allowing deletion of properties from built-in prototypes. Nowconstructorandprototypeare blocked unconditionally as non-terminal path keys, matchingbaseSet. Calls that previously returnedtrueand deleted the property now returnfalseand leave the target untouched._.template: Fixed code injection viaimportskeys (GHSA-r5fr-rjxr-66jc, CVE-2026-4800, 879aaa9). Fixes an incomplete patch for CVE-2021-23337. Thevariableoption was validated againstreForbiddenIdentifierCharsbutimportsKeyswas left unguarded, allowing code injection via the sameFunction()constructor sink.importskeys containing forbidden identifier characters now throw"Invalid imports option passed into _.template".Docs
_.templatein threat model and API docs (#6099)lower > upperbehavior in_.random(#6115)_.compactjsdoc (#6090)lodash.*modular packagesDiff
We have also regenerated and published a select number of the
lodash.*modular packages.These modular packages had fallen out of sync significantly from the minor/patch updates to lodash. Specifically, we have brought the following packages up to parity w/ the latest lodash release because they have had CVEs on them in the past:
mermaid-js/mermaid (mermaid)
v11.14.0Compare Source
Thanks to our awesome mermaid community that contributed to this release: @ashishjain0512, @tractorjuice, @autofix-ci[bot], @aloisklink, @knsv, @kibanana, @chandershekhar22, @khalil, @ytatsuno, @sidharthv96, @github-actions[bot], @dripcoding, @knsv-bot, @jeroensmink98, @Alex9583, @GhassenS, @omkarht, @darshanr0107, @leentaylor, @lee-treehouse, @veeceey, @turntrout, @Mermaid-Chart, @BambioGaming, Claude
Releases
@mermaid-js/examples@1.2.0
Minor Changes
efe218a- add new TreeView diagrammermaid@11.14.0
Minor Changes
#7526
efe218a- Add Wardley Maps diagram type (beta)Adds Wardley Maps as a new diagram type to Mermaid (available as
wardley-beta). Wardley Maps are visual representations of business strategy that help map value chains and component evolution.Features:
Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation.
#7526
efe218a- feat: implement neo look styling for state diagrams#7526
efe218a- feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling#7526
efe218a- feat: addrandomizeconfig option for architecture diagrams, defaulting tofalsefor deterministic layout#7526
efe218a- feat: Add option to change timeline direction#7526
efe218a- Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like#arrowheadshould use attribute-ending selectors like[id$="-arrowhead"]instead.#7526
efe218a- feat: implement neo look styling for ER diagrams#7526
efe218a- feat: implement neo look styling for requirement diagrams#7526
efe218a- feat: add theme support for data label colour in xy chart#7526
efe218a- feat: implement neo look styling for mindmap diagrams#7526
efe218a- feat: implement neo look for mermaid flowchart diagrams#7526
efe218a- feat: implement neo look and themes for class diagram#7526
efe218a- feat: add showDataLabelOutsideBar option for xy chart#7526
efe218a- feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling#7526
efe218a- feat: implement neo look and themes for gitGraph diagram#7526
efe218a- add new TreeView diagramPatch Changes
#7526
efe218a- add link to ishikawa diagram on mermaid.js.org#7526
efe218a- docs: document valid duration token formats in gantt.md#7526
efe218a- fix: ER diagram parsing when using "1" as entity identifier on right sideThe parser was incorrectly tokenizing the second "1" in patterns like
a many to 1 1:because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern"1"(?=\s+[0-9])to correctly identify the cardinality alias before a numeric entity name.Fixes #7472
#7526
efe218a- fix: scope cytoscape label style mapping to edges with labels to prevent console warnings#7526
efe218a- fix: support inline annotation syntax in class diagrams (class Shape <>)#7526
efe218a- fix: Align branch label background with text for multi-line labels in LR GitGraph layout#7526
efe218a- fix: preserve cause hierarchy when ishikawa effect is indented more than causes#7526
efe218a- refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads#7526
efe218a- fix: Prevent long pie chart titles from being clipped by expanding the viewBox#7526
efe218a- fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations#7526
efe218a- fix: warn whenstylestatement targets a non-existent node in flowcharts#7526
efe218a- fix: group state diagram SVG children under single root element#7526
efe218a- fix: Allow :::className syntax inside composite state blocks#7526
efe218aThanks @aloisklink, @BambioGaming! - fix: prevent escaping<and&whenhtmlLabels: false#7526
efe218a- fix: treemap title and labels use theme-aware colors for dark backgroundsUpdated dependencies [
efe218a]:@mermaid-js/parser@1.1.0
Minor Changes
efe218a- add new TreeView diagram@mermaid-js/tiny@11.14.0
Minor Changes
#7526
efe218a- Add Wardley Maps diagram type (beta)Adds Wardley Maps as a new diagram type to Mermaid (available as
wardley-beta). Wardley Maps are visual representations of business strategy that help map value chains and component evolution.Features:
Implementation includes parser, D3.js renderer, unit tests, E2E tests, and comprehensive documentation.
#7526
efe218a- feat: implement neo look styling for state diagrams#7526
efe218a- feat: implement neo look support for sequence diagrams with drop shadows, and enhanced styling#7526
efe218a- feat: addrandomizeconfig option for architecture diagrams, defaulting tofalsefor deterministic layout#7526
efe218a- feat: Add option to change timeline direction#7526
efe218a- Fix duplicate SVG element IDs when rendering multiple diagrams on the same page. Internal element IDs (nodes, edges, markers, clusters) are now prefixed with the diagram's SVG element ID across all diagram types. Custom CSS or JS using exact ID selectors like#arrowheadshould use attribute-ending selectors like[id$="-arrowhead"]instead.#7526
efe218a- feat: implement neo look styling for ER diagrams#7526
efe218a- feat: implement neo look styling for requirement diagrams#7526
efe218a- feat: add theme support for data label colour in xy chart#7526
efe218a- feat: implement neo look styling for mindmap diagrams#7526
efe218a- feat: implement neo look for mermaid flowchart diagrams#7526
efe218a- feat: implement neo look and themes for class diagram#7526
efe218a- feat: add showDataLabelOutsideBar option for xy chart#7526
efe218a- feat: implement neo look support for timeline diagram with drop shadows, additoinal redux themes and enhanced styling#7526
efe218a- feat: implement neo look and themes for gitGraph diagram#7526
efe218a- add new TreeView diagramPatch Changes
#7526
efe218a- add link to ishikawa diagram on mermaid.js.org#7526
efe218a- docs: document valid duration token formats in gantt.md#7526
efe218a- fix: ER diagram parsing when using "1" as entity identifier on right sideThe parser was incorrectly tokenizing the second "1" in patterns like
a many to 1 1:because the lookahead rule only checked for alphabetic characters after whitespace, not digits. Added a new lookahead pattern"1"(?=\s+[0-9])to correctly identify the cardinality alias before a numeric entity name.Fixes #7472
#7526
efe218a- fix: scope cytoscape label style mapping to edges with labels to prevent console warnings#7526
efe218a- fix: support inline annotation syntax in class diagrams (class Shape <>)#7526
efe218a- fix: Align branch label background with text for multi-line labels in LR GitGraph layout#7526
efe218a- fix: preserve cause hierarchy when ishikawa effect is indented more than causes#7526
efe218a- refactor: remove unused createGraphWithElements function and add regression test for open edge arrowheads#7526
efe218a- fix: Prevent long pie chart titles from being clipped by expanding the viewBox#7526
efe218a- fix: prevent sequence diagram hang when "as" is used without a trailing space in participant declarations#7526
efe218a- fix: warn whenstylestatement targets a non-existent node in flowcharts#7526
efe218a- fix: group state diagram SVG children under single root element#7526
efe218a- fix: Allow :::className syntax inside composite state blocks#7526
efe218aThanks @aloisklink, @BambioGaming! - fix: prevent escaping<and&whenhtmlLabels: false#7526
efe218a- fix: treemap title and labels use theme-aware colors for dark backgroundsUpdated dependencies [
efe218a]:v11.13.0Compare Source
Minor Changes
#7352
d6db0b0Thanks @remcohaszing! - feat: Export theAsyncIconLoader,SyncIconLoader, andIconLoadertypes.#5932
cdacb0bThanks @exoego! - feat: Add venn-beta diagram#6789
73e9849Thanks @omkarht! - feat: Add half-arrowheads (solid & stick) and central connection support#7387
acce4dbThanks @exoego! - feat: Add Ishikawa diagram (ishikawa-beta)#6995
9745f32Thanks @darshanr0107! - feat: Deprecateflowchart.htmlLabelsin favor of root-levelhtmlLabelsin Mermaid config#5814
2dd29beThanks @kairi003! - feat: allow to put notes in namespaces on classDiagramPatch Changes
#7075
96a766dThanks @darshanr0107! - fix: Prevent HTML tags from being escaped in sandbox label rendering#6843
32723b2Thanks @saurabhg772244! - fix: Support edge animation in hand drawn look#7453
a60e615Thanks @darshanr0107! - fix: ER diagram edge label positioning#6989
1a9d45aThanks @darshanr0107! - fix: Resolved parsing error where direction TD was not recognized within subgraphs#7178
96ca7c0Thanks @omkarht! - fix(treemap): Fixed treemap classDef style application to properly apply user-defined styles#7076
60f6331Thanks @darshanr0107! - fix: Correct viewBox casing and make SVGs responsive#7055
fa15ce8Thanks @darshanr0107! - fix: Improve participant parsing and prevent recursive loops on invalid syntax#7276
33c7c72Thanks @darshanr0107! - fix: respectmarkdownAutoWrap: falseto prevent text auto-wrapping in flowchart markdown labels withhtmlLabelsenabled.Markdown labels with
markdownAutoWrap: false, htmlLabels: falseset doesn't workcorrectly.
#7416
3c069b5Thanks @Crafter-Y! - fix: architecture diagram lines should now have the correct length#6995
9745f32Thanks @darshanr0107! - fix: Support thehtmlLabelsMermaid config value whenever possible#7293
a408b55Thanks @darshanr0107! - fix: Prevent browser hang when using multiline accDescr in XY charts#6119
712c1ecThanks @NealGooch! - fix: correct block positioning when nested blocks span multiple columns#7424
981a62eThanks @knsv! - fix: correct BT orientation arc sweep flags in gitGraph drawArrow()Swapped SVG arc sweep-flag values in the BT (bottom-to-top) orientation branches of
drawArrow()so curves bend in the correct direction. Affects both rerouting and non-rerouting code paths for merge and non-merge arrows.Resolves #6593
#7430
a4bb0b5Thanks @knsv! - fix: allow colons in stateDiagram-v2 transition and state description text#7432
b0f9d5bThanks @knsv! - fix: derive taskTextDarkColor from doneTaskBkgColor in dark theme for readable done-task text#7456
981fbb8Thanks @knsv-bot! - fix(gantt): restore readable outside-text color for done tasks in dark mode#7139
93aa657Thanks @omkarht! - revert: restore original hexagon and roundedRect implementations#7136
6bc6617Thanks @omkarht! - feat: add alias support for new participant syntax of sequence diagrams#7375
9d0669aThanks @kaigritun! - fix(er): recognize '1' cardinality alias before relationship operators#7275
7eed6a1Thanks @darshanr0107! - fix: changecreateLabelto callcreateTextThis adds support for KaTeX and FontAwesome icons loaded via iconpacks in some
older labels. There are some small changes in formatting due to standardizing this code.
#7265
2000680Thanks @omkarht! - fix: prevent unintended opacity on SVG aws icons containing rect elements#7139
b7c66a2Thanks @omkarht! - chore: restore original hexagon and roundedRect implementations#7425
f16bfbbThanks @knsv! - fix: use rounded right-angle edges for ELK layoutELK layout edges now default to
roundedcurve (right-angle segments with rounded corners) instead of inheriting the globalbasisdefault. This fixes ELK edges that were curving instead of routing at right angles (#7213). Non-ELK layouts are unaffected and keep their existingbasisdefault.#7296
aac86f7Thanks @darshanr0107! - fix: Ensure correct edge label rendering for ER and requirement diagrams when flowchart htmlLabels are false#7019
ace0367Thanks @darshanr0107! - fix: Mindmap breaking in ELK layout#6984
09b74f1Thanks @omkarht! - fix(er-diagram): prevent syntax error when using 'u', numbers, and decimals in node names#7276
33c7c72Thanks @darshanr0107! - fix: Restore proper rendering of plain text flowchart labels without auto line-wrappingThis fix restores backwards compatibility with Mermaid v10 by ensuring that plain text labels in flowcharts are rendered correctly. In Mermaid v11, all labels were incorrectly being treated as markdown by default, which caused issues with text wrapping, multiline breaks, and backwards compatibility.
What changed:
\ncharacters now correctly create line breaksIf you want markdown formatting:
You can still use markdown in your flowchart labels by using the proper markdown syntax. Wrap your markdown text with double quotes and backticks:
node["`_markdown_ **text**`"]Example:
#7080
835de00Thanks @darshanr0107! - fix: Support ComponentQueue_Ext to prevent parsing error#7310
a9e4c72Thanks @darshanr0107! - fix: Allow quoted string labels in architecture-beta diagrams#7052
ff15e51Thanks @darshanr0107! - fix: Correct tooltip placement to appear near hovered element#7197
8bfd477Thanks @omkarht! - fix: validate dates and tick interval to prevent UI freeze/crash in gantt diagramtype#7099
b136acdThanks @darshanr0107! - fix: Mindmap rendering issue when the number of Level 2 nodes exceeds 11#7217
e0317acThanks @omkarht! - fix(gitgraph): pass gitGraphConfig to renderer functions for applying directives properly.Updated dependencies [
fd3fc50]:nodejs/node (node)
v24.14.1: 2026-03-24, Version 24.14.1 'Krypton' (LTS), @RafaelGSS prepared by @juanarbolCompare Source
This is a security release.
Notable Changes
Commits
6fae244080] - (CVE-2026-21717) build,test: test array index hash collision (Joyee Cheung) nodejs-private/node-private#828cc0910c62e] - (CVE-2026-21713) crypto: use timing-safe comparison in Web Cryptography HMAC and KMAC (Filip Skokan) nodejs-private/node-private#82280cb042cf3] - deps: update undici to 7.24.4 (Node.js GitHub Bot) #62271f5b8667dc2] - deps: update undici to 7.24.3 (Node.js GitHub Bot) #6223308852637d9] - deps: update undici to 7.22.0 (Node.js GitHub Bot) #6203561097db9fb] - deps: upgrade npm to 11.11.0 (npm team) #619949ac0f9f81e] - deps: upgrade npm to 11.10.1 (npm team) #618923dab3c4698] - deps: V8: overridedepot_toolsversion (Richard Lau) #6234487521e99d1] - deps: V8: backport1361b2a(Joyee Cheung) nodejs-private/node-private#828045013366f] - deps: V8: backport185f0fe(Joyee Cheung) nodejs-private/node-private#828af22629ea8] - deps: V8: backport0a8b1cd(snek) nodejs-private/node-private#828380ea72eef] - (CVE-2026-21710) http: use null prototype for headersDistinct/trailersDistinct (Matteo Collina) [nodejs-private/node-private#821](https://redirect.github.com/nodejs-private/node-pConfiguration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR has been generated by Renovate Bot.