mirror of
https://github.com/tiennm99/DocsGPT.git
synced 2026-10-11 12:11:45 +00:00
mermaid 12 needs no source change; mermaidSecurity.ts and its strict-mode init-directive test pass unchanged. Adds a lodash-es ^4.18.1 override. mermaid 12 depends on chevrotain ~11.1.2 (mermaid 11 resolved chevrotain 12, which has no lodash-es), and chevrotain 11 pulls lodash-es <= 4.17.23, carrying GHSA-r5fr-rjxr-66jc and GHSA-f23m-r3pf-42rh, both high. 4.18.1 is the fixed line. Without the override the frontend gains 5 high-severity advisories. Verified rendering in Chromium rather than the unit suite, since happy-dom has no SVG getBBox and cannot render any mermaid version. Flowchart, sequence, pie, class, state, gantt, ER and mindmap all produce SVG on 12, matching 11 to the byte except classDiagram (+17 bytes). A strict-mode `click ... "javascript:..."` target is still stripped. 598 tests pass, build clean, 0 advisories.