fix(deps): update dependency mermaid to v10.9.8 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
mermaid	10.9.1 → 10.9.8

---

Mermaid improperly sanitizes sequence diagram labels leading to XSS

CVE-2025-54881 / GHSA-7rqq-prvp-x9jh

More information

Details

Summary

In the default configuration of mermaid 11.9.0, user supplied input for sequence diagram labels is passed to innerHTML during calculation of element size, causing XSS.

Details

Sequence diagram node labels with KaTeX delimiters are passed through calculateMathMLDimensions. This method passes the full label to innerHTML which allows allows malicious users to inject arbitrary HTML and cause XSS when mermaid-js is used in it's default configuration (with KaTeX support enabled).

The vulnerability lies here:

export const calculateMathMLDimensions = async (text: string, config: MermaidConfig) => {
  text = await renderKatex(text, config);
  const divElem = document.createElement('div');
  divElem.innerHTML = text; // XSS sink, text has not been sanitized.
  divElem.id = 'katex-temp';
  divElem.style.visibility = 'hidden';
  divElem.style.position = 'absolute';
  divElem.style.top = '0';
  const body = document.querySelector('body');
  body?.insertAdjacentElement('beforeend', divElem);
  const dim = { width: divElem.clientWidth, height: divElem.clientHeight };
  divElem.remove();
  return dim;
};

The calculateMathMLDimensions method was introduced in 5c69e5fdb004a6d0a2abe97e23d26e223a059832 two years ago, which was released in Mermaid 10.9.0.

PoC

Render the following diagram and observe the modified DOM.

sequenceDiagram
    participant A as Alice<img src="x" onerror="document.write(`xss on ${document.domain}`)">$$\\text{Alice}$$
    A->>John: Hello John, how are you?
    Alice-)John: See you later!

Here is a PoC on mermaid.live: https://mermaid.live/edit#pako:eNpVUMtOwzAQ_BWzyoFKaRTyaFILiio4IK7ckA-1km1iKbaLY6spUf4dJ0AF68uOZ2dm7REqXSNQ6PHDoarwWfDGcMkUudaJGysqceLKkj3hPdl3osJ7IRvSm-qBwcCAaIXGaONRrSsnUdnobITF28PQ954lwXglai25UNNhxWAXBMyXxcGOi-3kL_5k79e73atuFSUv2HWazH1IWn0m3CC5aPf4b3p2WK--BW-4DJCOWzQ3TM0HQmiMqIFa4zAEicZv4iGMsw0D26JEBtS3NR656ywDpiYv869_11r-Ko12TQv0yLveI3eqfcjP111HUNVonrRTFuhdsVgAHWEAmuRxlG7SuEzKMi-yJAnhAjTLIk_EcbFJtuk2y9MphM8lM47KIp--AOZghtU

Impact

XSS on all sites that use mermaid and render user supplied diagrams without further sanitization.

Remediation

The value of the text argument for the calculateMathMLDimensions method needs to be sanitized before getting passed on to innerHTML.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
• https://nvd.nist.gov/vuln/detail/CVE-2025-54881
• https://github.com/mermaid-js/mermaid/commit/5c69e5fdb004a6d0a2abe97e23d26e223a059832
• https://github.com/mermaid-js/mermaid/commit/685516a85ec1df64cefd4fd15f26533be87d458e
• https://github.com/advisories/GHSA-7rqq-prvp-x9jh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid: Improper sanitization of classDef in state diagrams leads to HTML injection

CVE-2026-41149 / GHSA-ghcm-xqfw-q4vr

More information

Details

Impact

Under the default configuration, Mermaid state diagram's classDef allow DOM injection that escapes the SVG, although <script> tags are removed, preventing XSS.

Proof-of-concept

stateDiagram-v2
  classDef xss fill:red</style></svg><style>*{x:x;y:y;overflow:visible!important;contain:none!important;transform:none!important;filter:none!important;clip-path:none!important}</style><div style="x:x;y:y;color:red;font:5em/1 monospace;display:grid;place-items:center;z-index:2147483647;width:100vw;height:100vh;position:fixed;top:0;left:0;background:black">HACKED</div><svg><style>a:b
  [*] --> A:::xss

Patches

• v11.15.0 (see 37ff937f1da2e19f882fd1db01235db4d01f4056)
• v10.9.6 (see 4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3)

Workarounds

If you can not update to a patched version, setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Credits

Thanks to @​zsxsoft from @​KeenSecurityLab for reporting this vulnerability.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr
• https://github.com/mermaid-js/mermaid/commit/37ff937f1da2e19f882fd1db01235db4d01f4056
• https://github.com/mermaid-js/mermaid/commit/4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6
• https://mermaid.js.org/config/schema-docs/config.html#securitylevel
• https://nvd.nist.gov/vuln/detail/CVE-2026-41149
• https://github.com/advisories/GHSA-ghcm-xqfw-q4vr

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid: Improper sanitization of classDefs in diagrams leads to CSS injection

CVE-2026-41148 / GHSA-xcj9-5m2h-648r

More information

Details

Details

The state diagram and any other diagram type that routes user-controlled style strings through createCssStyles parser for Mermaid v11.14.0 and earlier captures classDef values with an unrestricted regex:

// packages/mermaid/src/diagrams/state/parser/stateDiagram.jison:83
<CLASSDEFID>[^\n]*   { this.popState(); return 'CLASSDEF_STYLEOPTS' }

The value passes unsanitized through addStyleClass() -> createCssStyles() -> style.innerHTML (mermaidAPI.ts:418). A } in the value closes the generated CSS selector, and everything after becomes a new CSS rule on the page.

PoC

stateDiagram-v2 
      classDef x }*{ background-image: url("http://media.giphy.com/media/SggILpMXO7Xt6/giphy.gif")}

Live demo:
https://mermaid.live/edit#pako:eNpFjzFvgzAQhf-KdVNbEcBgMHhtlkqtOnSJKi8ONsYKBmRMlRTx3-skanvTfbp7996t0IxSAYPZC6_2Rmgn7O4rQ00v5nmvWnRG29OKjqI5aTcug9wZK7RiaHH9A4fO-4kliVXSiFibqbvEzWjvnHxo_fI6vR3e6cGXyX2qTcvhcYMItDMSmHeLisAqZ8UVYeUDQhx8p6ziwEIrhTtx4MNVM4nhcxztrywE0h2wVvRzoGWS_z_8rahBKvcckntgmN5OAFvhDIzUNCZZQXCR5nVaZkUEF2BVFpOcEkoxxhUuyRbB980yjStapKHqoKFlhvPtB7BFZEU

Patches

This has been patched in:

• v11.15.0 (see e9b0f34d8d82a6260077764ee45e1d7d90957a0f)
• v10.9.6 (see 8fead23c59166b7bab6a39eac81acebee2859102)

Workarounds

Setting "securityLevel": "sandbox" will prevent this, by rendering the mermaid diagram in a sandboxed <iframe>.

Impact

Enables page defacement, user tracking via url() callbacks, and DOM attribute exfiltration via CSS :has() selectors.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r
• https://github.com/mermaid-js/mermaid/commit/8fead23c59166b7bab6a39eac81acebee2859102
• https://github.com/mermaid-js/mermaid/commit/e9b0f34d8d82a6260077764ee45e1d7d90957a0f
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6
• https://mermaid.js.org/config/schema-docs/config.html#securitylevel
• https://nvd.nist.gov/vuln/detail/CVE-2026-41148
• https://github.com/advisories/GHSA-xcj9-5m2h-648r

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid: Improper sanitization of configuration leads to CSS injection

CVE-2026-41159 / GHSA-87f9-hvmw-gh4p

More information

Details

Impact

Mermaid's default configuration allows injecting CSS that applies outside of the Mermaid diagram via the fontFamily, themeCSS, and altFontFamily configuration options.

Live demo: mermaid.live

Example code:

%%{init: {"fontFamily": "x;a{b} :not(&){background:green !important} c{d}"}}%%
flowchart LR
    A --> B

The injected CSS exploits stylis's & (scope reference) handling. :not(&) escapes the #mermaid-xxx automatic scoping, applying styles to all page elements. Global at-rules (@font-face, @keyframes, @counter-style) are also injectable as stylis hoists them to top level.

This allows page defacement and DOM attribute exfiltration via CSS :has() selectors.

Patches

• v11.15.0 (see 64769738d5b59211e1decb471ffbaca8afec51aa)
• v10.9.6 (see a9d9f0d8eb790349121508688cd338253fd80d76)

Workarounds

If you can't upgrade mermaid, you can set the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables.

Setting "securityLevel": "sandbox" will also prevent this.

Credits

Reported by @​zsxsoft on behalf of @​KeenSecurityLab

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p
• https://github.com/mermaid-js/mermaid/commit/64769738d5b59211e1decb471ffbaca8afec51aa
• https://github.com/mermaid-js/mermaid/commit/a9d9f0d8eb790349121508688cd338253fd80d76
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6
• https://nvd.nist.gov/vuln/detail/CVE-2026-41159
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.15.0
• https://github.com/advisories/GHSA-87f9-hvmw-gh4p

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS

CVE-2026-41150 / GHSA-6m6c-36f7-fhxh

More information

Details

Impact

Mermaid v11.14.0 and earlier are vulnerable to a denial-of-service attack when rendering gantt charts, if they use the excludes attribute to exclude all dates.

Example:

gantt
  excludes monday,tuesday,wednesday,thursday,friday,saturday,sunday
  DoS :2025-01-01, 1d

mermaid.parse is unaffected, unless you then call the ganttDb.getTasks() (which is called when rendering a diagram).

Patches

This has been patched in:

• v11.15.0 (see faafb5d49106dd32c367f3882505f2dd625aa30e)
• v10.9.6 (see a59ea56174712ee5430dfd5bc877cb5151f501a6)

Workarounds

There are no workarounds available without updating to a newer version of mermaid.

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh
• https://github.com/mermaid-js/mermaid/commit/a59ea56174712ee5430dfd5bc877cb5151f501a6
• https://github.com/mermaid-js/mermaid/commit/faafb5d49106dd32c367f3882505f2dd625aa30e
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.6
• https://nvd.nist.gov/vuln/detail/CVE-2026-41150
• https://github.com/advisories/GHSA-6m6c-36f7-fhxh

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid XY Charts are vulnerable to an infinite loop DoS

CVE-2026-71436 / GHSA-2v8p-3f2j-5mp7

More information

Details

Impact

Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.

As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.

Proof-of-concept

xychart
  x-axis 1 --> 1
  line [1, 2]

Patches

This has been patched in mermaid-js/mermaid@630aa7e and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in Mermaid v10.9.8

Workarounds

There are no known workarounds. Please update to the latest version or apply the patch.

References

• mermaid-js/mermaid@630aa7e
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• mermaid-js/mermaid@ef60adc
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-2v8p-3f2j-5mp7
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289
• https://github.com/mermaid-js/mermaid/commit/ef60adc837d9d5107af21285f01e83dea309bd0a
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
• https://github.com/advisories/GHSA-2v8p-3f2j-5mp7

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid configuration APIs allow prototype pollution

CVE-2026-71438 / GHSA-c4c3-pg64-4m4v

More information

Details

Summary

Mermaid's configuration setters (mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig) merge the caller-supplied configuration object into Mermaid's internal config using the assignWithDepth deep-merge helper that is vulnerable to prototype pollution.

Because these APIs are intended to receive trusted configuration supplied by the application integrating Mermaid, Mermaid assesses the practical risk as low. The vulnerability is only reachable if an application forwards attacker-controlled data directly into one of these configuration entry points, which is outside their documented usage.

User-controlled configuration (e.g. configuration in diagram code using %%{init: {}}%% or YAML frontmatter) are already protected from prototype pollution.

Patches

This has been patched in mermaid-js/mermaid@2cd6dcf and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in c34b07a0815842327e70794d69b0c8c5a1e2a956 and was released in Mermaid v10.9.8

Impact

Mermaid believes it's unlikely that anybody is impacted, as these functions are configuration entry points expected to receive trusted, developer-controlled values as they can modify other security-relevant configuration.

Workarounds

Don't pass user-controlled data to the mermaid.initialize, mermaidAPI.setConfig, and mermaidAPI.updateSiteConfig functions. Instead, users can use %%{init: {}}%% or YAML frontmatter in diagrams.

Reporters

• liyi.zhou@sydney.edu.au (Liyi), https://lzhou1110.github.io/
• ziyue0530@​gmail.com (Ziyue), https://zyy0530.github.io/
• cshe0476@​uni.sydney.edu.au (Strick), https://str1ckl4nd.github.io/
• chng0012@​uni.sydney.edu.au (Maurice), http://maurice.busystar.org/
• cyu210608@​gmail.com (Chenchen), https://7thparkk.github.io/

Severity

• CVSS Score: 2.4 / 10 (Low)
• Vector String: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-c4c3-pg64-4m4v
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/2cd6dcf735533b323507e3e889ffdea870540b43
• https://github.com/mermaid-js/mermaid/commit/c34b07a0815842327e70794d69b0c8c5a1e2a956
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
• https://github.com/advisories/GHSA-c4c3-pg64-4m4v

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Mermaid allows CSS injection applying to sibling elements of the diagram

CVE-2026-50159 / GHSA-6x64-9x62-f2gx

More information

Details

Summary

Mermaid does not fully restrict CSS to the rendered SVG subtree. Although selectors are prefixed with #mermaid-X, sibling (~ and +) combinators can still escape the Mermaid container and inject styles to DOM elements adjacent to the diagram <svg>.

Most users of mermaid would not be affected by this, as mermaid adds its <svg> as an only child of it's parent element. However, you may be affected if you manually insert the <svg> (or other elements) into the DOM yourself.

Details

Mermaid namespaces CSS through with a middleware intended to scope all rules to the diagram's SVG element. CSS nesting expands & ~ * { ... } to #svgId ~ *, which selects all sibling elements following the SVG in the DOM, outside the diagram boundary.

Impact

An attacker able to supply diagram source to a page (e.g., user-generated content rendered by Mermaid) could inject CSS rules affecting sibling elements to the diagram <svg> on the host page. This can be used for UI redressing, hiding content, conditional CSS-based probing, or phishing-style visual manipulation.

JavaScript execution is not possible via this vector.

Patches

This has been patched in mermaid-js/mermaid@12d472c and released in Mermaid v11.16.1.

A backport has been made for the v10 branch in 7e83f1533318b307764d961906a73377266f4c5e and was released in Mermaid v10.9.8

Workarounds

If you are inserting the <svg> into the DOM yourself, you can wrap it in an element with no other children, e.g. <div><svg>...</svg></div> or element.innerHTML = svg. Alternatively, you can use mermaid.run() or mermaid.initialize() which will do this for you.

Setting "securityLevel": "sandbox" will also prevent this, or setting the secure config value in the mermaid config to avoid allowing diagrams to modify fontFamily, themeCSS, altFontFamily, and themeVariables.

To test, you can try using a themeCSS with & + * { /* my CSS here */} and see if it's applied outside of your mermaid <svg>.

---
config:
  themeCSS: |-
    & + * { background:red !important; width:100vw !important; height:100vh !important; position:fixed !important; inset:0 !important; }
---
info

References

• GHSA-87f9-hvmw-gh4p/CVE-2026-41159 (related vulnerability)
• mermaid-js/mermaid@12d472c
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1
• mermaid-js/mermaid@7e83f15
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L

References

• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6x64-9x62-f2gx
• https://github.com/mermaid-js/mermaid/pull/8022
• https://github.com/mermaid-js/mermaid/commit/12d472c9ed43f94814b110da8d7a9ae6dd5266ed
• https://github.com/mermaid-js/mermaid/commit/7e83f1533318b307764d961906a73377266f4c5e
• https://github.com/mermaid-js/mermaid/releases/tag/mermaid@11.16.1
• https://github.com/mermaid-js/mermaid/releases/tag/v10.9.8
• https://github.com/advisories/GHSA-6x64-9x62-f2gx

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

mermaid-js/mermaid (mermaid)

v10.9.8

Compare Source

Backports the following fixes from Mermaid v11.16.1.

• GHSA-c4c3-pg64-4m4v
  • fix: increase protections against prototype pollution
  • deprecate: Deprecate the mermaidAPI.setConfig() function
• GHSA-6x64-9x62-f2gx - fix: handle CSS sibling combinators in compileCSS
• GHSA-2v8p-3f2j-5mp7 - fix(xychart): support zero-width x-axis ranges

Due to a publish error, v10.9.7 was skipped.

Full Changelog: mermaid-js/mermaid@v10.9.6...v10.9.8

v10.9.6

Compare Source

Backports the following security fixes from Mermaid v11.15.0:

• CVE-2026-41150: fix(gantt): limit loop if excluding all dates (a59ea56)
• CVE-2026-41148: fix: prevent unbalanced CSS styles in classDefs (8fead23)
• CVE-2026-41149: fix: create CSS styles using the CSSOM (4e2d512)
• CVE-2026-41159: fix: block stylis scope escape (a9d9f0d)
• CVE-2026-41907: fix: loosen uuid dependency range to allow v14
  We don't use this vulnerable code, but it allows users to silence this warning.
  (e8c7043)

And other dependency updates.

Full Changelog: mermaid-js/mermaid@v10.9.5...v10.9.6

v10.9.5

Compare Source

This release backports the update of the dependency dagre-d3-es to 7.0.13 for CVE-2025-57347 from v11.12.1.

We've also updated the v10.x branch to support newer versions of DOMPurify, cherry-picked from fe3cffb, avoiding CVE-2025-26791.

Full Changelog: mermaid-js/mermaid@v10.9.4...v10.9.5

v10.9.4

Compare Source

This release backports the fix for GHSA-7rqq-prvp-x9jh from v11.10.0, preventing a potential XSS attack in labels in sequence diagrams.

See: 9d68517 (on main branch)
See: 7509b06 (backported commit)

Full Changelog: mermaid-js/mermaid@v10.9.3...v10.9.4

v10.9.3

Compare Source

Updates the bundled version of dependencies in the following files:

• dist/mermaid.min.js
• dist/mermaid.js
• dist/mermaid.esm.mjs
• dist/mermaid.esm.min.mjs

If you are not using these files (e.g. you are using the default NPM export of mermaid, e.g. import mermaid from 'mermaid', or you are using dist/mermaid.core.mjs), this release is identical to v10.9.2.

This is to avoid potential security issues in KaTeX and DOMPurify, see:

• GHSA-mmhx-hmjr-r674
• GHSA-64fm-8hw2-v72w
• GHSA-cvr6-37gx-v8wc
• GHSA-f98w-7cxr-ff2h
• GHSA-3wc5-fcw2-2329

These dependencies have already been updated in v11.0.0.

Changelog

Chore

• Updates the bundled version of KaTeX to 0.16.11 (2bedd0e)
• Updates the bundled version of DOMPurify to 3.1.6 (92a07ff)

Full Changelog: mermaid-js/mermaid@v10.9.2...v10.9.3

v10.9.2

Compare Source

This release back-ports #​5914 to the v10 release line to fix #​5904 (an incompatibility between mermaid and DOMPurify v3.1.7)

Patch Changes

• #​5914 402abdf [10] fix: ban version v3.1.7 of DOMPurify

Full Changelog: mermaid-js/mermaid@v10.9.1...v10.9.2

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.