From 90c19f01b2a2f55f5c92880633488e15bcd93281 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Mon, 24 Aug 2026 16:07:14 -0500 Subject: [PATCH 1/4] fix: update mermaid to ^11.17.0 (CVE-2026-71436) Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- .../package-lock.json | 44 ++++++++---- .../markdown-language-features/package.json | 2 +- .../package-lock.json | 68 ++++++++++++------- .../mermaid-markdown-features/package.json | 2 +- 4 files changed, 74 insertions(+), 42 deletions(-) diff --git a/code/extensions/markdown-language-features/package-lock.json b/code/extensions/markdown-language-features/package-lock.json index 39aeb3014253..f2cd2360ce25 100644 --- a/code/extensions/markdown-language-features/package-lock.json +++ b/code/extensions/markdown-language-features/package-lock.json @@ -15,7 +15,7 @@ "highlight.js": "^11.8.0", "katex": "^0.16.33", "markdown-it": "^14.2.0", - "mermaid": "^11.15.0", + "mermaid": "^11.17.0", "morphdom": "^2.7.7", "picomatch": "^2.3.2", "punycode": "^2.3.1", @@ -85,12 +85,12 @@ } }, "node_modules/@mermaid-js/parser": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz", - "integrity": "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==", + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.1.tgz", + "integrity": "sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==", "license": "MIT", "dependencies": { - "@chevrotain/types": "~11.1.1" + "@chevrotain/types": "~11.1.2" } }, "node_modules/@microsoft/1ds-core-js": { @@ -1392,6 +1392,15 @@ "benchmarks" ] }, + "node_modules/fastdom": { + "version": "1.0.12", + "resolved": "https://registry.npmjs.org/fastdom/-/fastdom-1.0.12.tgz", + "integrity": "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==", + "license": "MIT", + "dependencies": { + "strictdom": "^1.0.1" + } + }, "node_modules/hachure-fill": { "version": "0.5.2", "resolved": "https://registry.npmjs.org/hachure-fill/-/hachure-fill-0.5.2.tgz", @@ -1561,26 +1570,27 @@ "license": "MIT" }, "node_modules/mermaid": { - "version": "11.15.0", - "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.15.0.tgz", - "integrity": "sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==", + "version": "11.17.1", + "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.1.tgz", + "integrity": "sha512-G1BP6qU4BRwEGk2SdsxgDk1cSuApimT32Nkb52YRSv+856FrmB8qo28BaNk9Ee8Fvuon3OxpXDJ4L6cD5AykXg==", "license": "MIT", "dependencies": { - "@braintree/sanitize-url": "^7.1.1", + "@braintree/sanitize-url": "^7.1.2", "@iconify/utils": "^3.0.2", - "@mermaid-js/parser": "^1.1.1", + "@mermaid-js/parser": "^1.2.1", "@types/d3": "^7.4.3", "@upsetjs/venn.js": "^2.0.0", - "cytoscape": "^3.33.1", + "cytoscape": "^3.34.0", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", - "dayjs": "^1.11.19", - "dompurify": "^3.3.1", + "dayjs": "^1.11.21", + "dompurify": "^3.3.3", "es-toolkit": "^1.45.1", - "katex": "^0.16.25", + "fastdom": "1.0.12", + "katex": "^0.16.47", "khroma": "^2.1.0", "marked": "^16.3.0", "roughjs": "^4.6.6", @@ -2296,6 +2306,12 @@ "node": ">=10" } }, + "node_modules/strictdom": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/strictdom/-/strictdom-1.0.1.tgz", + "integrity": "sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==", + "license": "MIT" + }, "node_modules/stylis": { "version": "4.4.0", "resolved": "https://registry.npmjs.org/stylis/-/stylis-4.4.0.tgz", diff --git a/code/extensions/markdown-language-features/package.json b/code/extensions/markdown-language-features/package.json index 72e1aa119ef6..1cb724bf82e8 100644 --- a/code/extensions/markdown-language-features/package.json +++ b/code/extensions/markdown-language-features/package.json @@ -904,7 +904,7 @@ "highlight.js": "^11.8.0", "katex": "^0.16.33", "markdown-it": "^14.2.0", - "mermaid": "^11.15.0", + "mermaid": "^11.17.0", "morphdom": "^2.7.7", "picomatch": "^2.3.2", "punycode": "^2.3.1", diff --git a/code/extensions/mermaid-markdown-features/package-lock.json b/code/extensions/mermaid-markdown-features/package-lock.json index 0661e3eee591..381e41c845fb 100644 --- a/code/extensions/mermaid-markdown-features/package-lock.json +++ b/code/extensions/mermaid-markdown-features/package-lock.json @@ -15,7 +15,7 @@ "@mermaid-js/layout-tidy-tree": "^0.2.0", "@mermaid-js/mermaid-zenuml": "^0.2.0", "dompurify": "^3.4.10", - "mermaid": "^11.15.0" + "mermaid": "^11.17.0" }, "devDependencies": { "@types/markdown-it": "^14.1.0", @@ -53,9 +53,9 @@ } }, "node_modules/@braintree/sanitize-url": { - "version": "7.1.1", - "resolved": "https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-7.1.1.tgz", - "integrity": "sha512-i1L7noDNxtFyL5DmZafWy1wRVhGehQmzZaz1HiN5e7iylJMSZR7ekOV7NsIqa5qBldlLrsKv4HbgFUVlQrz8Mw==", + "version": "7.1.2", + "resolved": "https://registry.npmjs.org/@braintree/sanitize-url/-/sanitize-url-7.1.2.tgz", + "integrity": "sha512-jigsZK+sMF/cuiB7sERuo9V7N9jx+dhmHHnQyDSVdpZwVutaBu7WvNYqMDLSgFgfB30n452TP3vjDAvFC973mA==", "license": "MIT" }, "node_modules/@chevrotain/types": { @@ -299,12 +299,12 @@ } }, "node_modules/@mermaid-js/parser": { - "version": "1.1.1", - "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.1.1.tgz", - "integrity": "sha512-VuHdsYMK1bT6X2JbcAaWAhugTRvRBRyuZgd+c22swUeI9g/ntaxF7CY7dYarhZovofCbUNO0G7JesfmNtjYOCw==", + "version": "1.2.1", + "resolved": "https://registry.npmjs.org/@mermaid-js/parser/-/parser-1.2.1.tgz", + "integrity": "sha512-n12NohV3mrUyUL2o93IgG/ifeW9FTyeJn3zDxkhwa8MJ9Fxg3HQMlA3RiGmD/3UnJvheztkjjQAjA2T4LmUcpw==", "license": "MIT", "dependencies": { - "@chevrotain/types": "~11.1.1" + "@chevrotain/types": "~11.1.2" } }, "node_modules/@napi-rs/canvas": { @@ -1319,9 +1319,9 @@ } }, "node_modules/cytoscape": { - "version": "3.33.1", - "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.33.1.tgz", - "integrity": "sha512-iJc4TwyANnOGR1OmWhsS9ayRS3s+XQ185FmuHObThD+5AeJCakAAbWv8KimMTt08xCCLNgneQwFp+JRJOr9qGQ==", + "version": "3.34.1", + "resolved": "https://registry.npmjs.org/cytoscape/-/cytoscape-3.34.1.tgz", + "integrity": "sha512-Lr0RvH9H75y9ar8h9Toy6u4lxRSCcxUq+hHcQ26sVWo6BnaQp1gwEZOYqwuYTZhyW7npyKnNLP8oJ2p1/3OZ7g==", "license": "MIT", "engines": { "node": ">=0.10" @@ -1818,9 +1818,9 @@ } }, "node_modules/dayjs": { - "version": "1.11.20", - "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.20.tgz", - "integrity": "sha512-YbwwqR/uYpeoP4pu043q+LTDLFBLApUP6VxRihdfNTqu4ubqMlGDLd6ErXhEgsyvY0K6nCs7nggYumAN+9uEuQ==", + "version": "1.11.23", + "resolved": "https://registry.npmjs.org/dayjs/-/dayjs-1.11.23.tgz", + "integrity": "sha512-QDTCU0M0MxR3hQfnlDJfwekQiaanm1ubOD231u73WBckQ/fsamwRLiE2GBz6D3a/xF1NgfiDLJjXBa1hYOYTtQ==", "license": "MIT" }, "node_modules/delaunator": { @@ -1933,6 +1933,15 @@ "node": ">=6" } }, + "node_modules/fastdom": { + "version": "1.0.12", + "resolved": "https://registry.npmjs.org/fastdom/-/fastdom-1.0.12.tgz", + "integrity": "sha512-LB+xjSTEbjHE1cWsxu+tN2Xqr1kpi+V9aADI7sVM5ZMaXyYGPHULQMzpJMYqOTULK/73pUkWVzzObFRBkPr+hg==", + "license": "MIT", + "dependencies": { + "strictdom": "^1.0.1" + } + }, "node_modules/fastq": { "version": "1.20.1", "resolved": "https://registry.npmjs.org/fastq/-/fastq-1.20.1.tgz", @@ -2186,9 +2195,9 @@ } }, "node_modules/katex": { - "version": "0.16.44", - "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.44.tgz", - "integrity": "sha512-EkxoDTk8ufHqHlf9QxGwcxeLkWRR3iOuYfRpfORgYfqc8s13bgb+YtRY59NK5ZpRaCwq1kqA6a5lpX8C/eLphQ==", + "version": "0.16.47", + "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz", + "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==", "funding": [ "https://opencollective.com/katex", "https://github.com/sponsors/katex" @@ -2273,26 +2282,27 @@ } }, "node_modules/mermaid": { - "version": "11.15.0", - "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.15.0.tgz", - "integrity": "sha512-pTMbcf3rWdtLiYGpmoTjHEpeY8seiy6sR+9nD7LOs8KfUbHE4lOUAprTRqRAcWSQ6MQpdX+YEsxShtGsINtPtw==", + "version": "11.17.0", + "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.0.tgz", + "integrity": "sha512-Jo9N377Wb4MSnHFPTbLi2SxFpsQl4eVHoxnW5U1Md9EazvgMp3s+4ohDxr81YNTgbn5Kj7HJ3yslrSJ52kwpbA==", "license": "MIT", "dependencies": { - "@braintree/sanitize-url": "^7.1.1", + "@braintree/sanitize-url": "^7.1.2", "@iconify/utils": "^3.0.2", - "@mermaid-js/parser": "^1.1.1", + "@mermaid-js/parser": "^1.2.1", "@types/d3": "^7.4.3", "@upsetjs/venn.js": "^2.0.0", - "cytoscape": "^3.33.1", + "cytoscape": "^3.34.0", "cytoscape-cose-bilkent": "^4.1.0", "cytoscape-fcose": "^2.2.0", "d3": "^7.9.0", "d3-sankey": "^0.12.3", "dagre-d3-es": "7.0.14", - "dayjs": "^1.11.19", - "dompurify": "^3.3.1", + "dayjs": "^1.11.21", + "dompurify": "^3.3.3", "es-toolkit": "^1.45.1", - "katex": "^0.16.25", + "fastdom": "1.0.12", + "katex": "^0.16.47", "khroma": "^2.1.0", "marked": "^16.3.0", "roughjs": "^4.6.6", @@ -2970,6 +2980,12 @@ "node": ">= 10.x" } }, + "node_modules/strictdom": { + "version": "1.0.1", + "resolved": "https://registry.npmjs.org/strictdom/-/strictdom-1.0.1.tgz", + "integrity": "sha512-cEmp9QeXXRmjj/rVp9oyiqcvyocWab/HaoN4+bwFeZ7QzykJD6L3yD4v12K1x0tHpqRqVpJevN3gW7kyM39Bqg==", + "license": "MIT" + }, "node_modules/string_decoder": { "version": "1.3.0", "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.3.0.tgz", diff --git a/code/extensions/mermaid-markdown-features/package.json b/code/extensions/mermaid-markdown-features/package.json index 185c50474f52..b2e4b90132cd 100644 --- a/code/extensions/mermaid-markdown-features/package.json +++ b/code/extensions/mermaid-markdown-features/package.json @@ -261,7 +261,7 @@ "@mermaid-js/layout-tidy-tree": "^0.2.0", "@mermaid-js/mermaid-zenuml": "^0.2.0", "dompurify": "^3.4.10", - "mermaid": "^11.15.0" + "mermaid": "^11.17.0" }, "overrides": { "lodash-es": "4.18.1", From d2c5e6b9d64aa972355832e7b6253f542ef8eee5 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Mon, 24 Aug 2026 16:59:24 -0500 Subject: [PATCH 2/4] chore: add rebase rules for mermaid update Co-Authored-By: Claude Opus 4.6 Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 7 +++++++ .../extensions/markdown-language-features/package.json | 5 +++++ .../code/extensions/mermaid-markdown-features/package.json | 5 +++++ rebase.sh | 2 ++ 4 files changed, 19 insertions(+) create mode 100644 .rebase/override/code/extensions/markdown-language-features/package.json create mode 100644 .rebase/override/code/extensions/mermaid-markdown-features/package.json diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 0e17c617a802..483a20cc0f2b 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -13,6 +13,13 @@ https://github.com/che-incubator/che-code/pull/791 - code/test/monaco/package.json --- +#### @sbouchet +https://github.com/che-incubator/che-code/pull/NNN + +- code/extensions/mermaid-markdown-features/package.json +- code/extensions/markdown-language-features/package.json +--- + #### @rnikitenko https://github.com/che-incubator/che-code/commit/177a26a8ef76ea41a26eb6ac0ef9d6006b9af53e diff --git a/.rebase/override/code/extensions/markdown-language-features/package.json b/.rebase/override/code/extensions/markdown-language-features/package.json new file mode 100644 index 000000000000..6e81eead2b44 --- /dev/null +++ b/.rebase/override/code/extensions/markdown-language-features/package.json @@ -0,0 +1,5 @@ +{ + "dependencies": { + "mermaid": "^11.17.0" + } +} diff --git a/.rebase/override/code/extensions/mermaid-markdown-features/package.json b/.rebase/override/code/extensions/mermaid-markdown-features/package.json new file mode 100644 index 000000000000..6e81eead2b44 --- /dev/null +++ b/.rebase/override/code/extensions/mermaid-markdown-features/package.json @@ -0,0 +1,5 @@ +{ + "dependencies": { + "mermaid": "^11.17.0" + } +} diff --git a/rebase.sh b/rebase.sh index ac81f8e2477c..8b5143b46b4a 100755 --- a/rebase.sh +++ b/rebase.sh @@ -519,6 +519,8 @@ resolve_conflicts() { apply_package_changes_by_path "$conflictingFile" elif [[ "$conflictingFile" == "code/extensions/markdown-language-features/package.json" ]]; then apply_package_changes_by_path "$conflictingFile" + elif [[ "$conflictingFile" == "code/extensions/mermaid-markdown-features/package.json" ]]; then + apply_package_changes_by_path "$conflictingFile" elif [[ "$conflictingFile" == "code/src/vs/platform/workspaces/common/workspaceIdentifier.ts" ]]; then apply_changes_multi_line "$conflictingFile" else From 7f3c6409063d915b755c66bef3239bdd83981ba4 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Tue, 25 Aug 2026 09:46:42 -0500 Subject: [PATCH 3/4] bumped to latest 11.17.1 Signed-off-by: Stephane Bouchet --- .../extensions/markdown-language-features/package.json | 2 +- .../extensions/mermaid-markdown-features/package.json | 2 +- .../markdown-language-features/package-lock.json | 2 +- code/extensions/markdown-language-features/package.json | 2 +- .../mermaid-markdown-features/package-lock.json | 8 ++++---- code/extensions/mermaid-markdown-features/package.json | 2 +- 6 files changed, 9 insertions(+), 9 deletions(-) diff --git a/.rebase/override/code/extensions/markdown-language-features/package.json b/.rebase/override/code/extensions/markdown-language-features/package.json index 6e81eead2b44..185e3a3df075 100644 --- a/.rebase/override/code/extensions/markdown-language-features/package.json +++ b/.rebase/override/code/extensions/markdown-language-features/package.json @@ -1,5 +1,5 @@ { "dependencies": { - "mermaid": "^11.17.0" + "mermaid": "^11.17.1" } } diff --git a/.rebase/override/code/extensions/mermaid-markdown-features/package.json b/.rebase/override/code/extensions/mermaid-markdown-features/package.json index 6e81eead2b44..185e3a3df075 100644 --- a/.rebase/override/code/extensions/mermaid-markdown-features/package.json +++ b/.rebase/override/code/extensions/mermaid-markdown-features/package.json @@ -1,5 +1,5 @@ { "dependencies": { - "mermaid": "^11.17.0" + "mermaid": "^11.17.1" } } diff --git a/code/extensions/markdown-language-features/package-lock.json b/code/extensions/markdown-language-features/package-lock.json index f2cd2360ce25..7df50508561a 100644 --- a/code/extensions/markdown-language-features/package-lock.json +++ b/code/extensions/markdown-language-features/package-lock.json @@ -15,7 +15,7 @@ "highlight.js": "^11.8.0", "katex": "^0.16.33", "markdown-it": "^14.2.0", - "mermaid": "^11.17.0", + "mermaid": "^11.17.1", "morphdom": "^2.7.7", "picomatch": "^2.3.2", "punycode": "^2.3.1", diff --git a/code/extensions/markdown-language-features/package.json b/code/extensions/markdown-language-features/package.json index 1cb724bf82e8..9b3120d4ddee 100644 --- a/code/extensions/markdown-language-features/package.json +++ b/code/extensions/markdown-language-features/package.json @@ -904,7 +904,7 @@ "highlight.js": "^11.8.0", "katex": "^0.16.33", "markdown-it": "^14.2.0", - "mermaid": "^11.17.0", + "mermaid": "^11.17.1", "morphdom": "^2.7.7", "picomatch": "^2.3.2", "punycode": "^2.3.1", diff --git a/code/extensions/mermaid-markdown-features/package-lock.json b/code/extensions/mermaid-markdown-features/package-lock.json index 381e41c845fb..5f83cd9990f3 100644 --- a/code/extensions/mermaid-markdown-features/package-lock.json +++ b/code/extensions/mermaid-markdown-features/package-lock.json @@ -15,7 +15,7 @@ "@mermaid-js/layout-tidy-tree": "^0.2.0", "@mermaid-js/mermaid-zenuml": "^0.2.0", "dompurify": "^3.4.10", - "mermaid": "^11.17.0" + "mermaid": "^11.17.1" }, "devDependencies": { "@types/markdown-it": "^14.1.0", @@ -2282,9 +2282,9 @@ } }, "node_modules/mermaid": { - "version": "11.17.0", - "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.0.tgz", - "integrity": "sha512-Jo9N377Wb4MSnHFPTbLi2SxFpsQl4eVHoxnW5U1Md9EazvgMp3s+4ohDxr81YNTgbn5Kj7HJ3yslrSJ52kwpbA==", + "version": "11.17.1", + "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.17.1.tgz", + "integrity": "sha512-G1BP6qU4BRwEGk2SdsxgDk1cSuApimT32Nkb52YRSv+856FrmB8qo28BaNk9Ee8Fvuon3OxpXDJ4L6cD5AykXg==", "license": "MIT", "dependencies": { "@braintree/sanitize-url": "^7.1.2", diff --git a/code/extensions/mermaid-markdown-features/package.json b/code/extensions/mermaid-markdown-features/package.json index b2e4b90132cd..829e101412c8 100644 --- a/code/extensions/mermaid-markdown-features/package.json +++ b/code/extensions/mermaid-markdown-features/package.json @@ -261,7 +261,7 @@ "@mermaid-js/layout-tidy-tree": "^0.2.0", "@mermaid-js/mermaid-zenuml": "^0.2.0", "dompurify": "^3.4.10", - "mermaid": "^11.17.0" + "mermaid": "^11.17.1" }, "overrides": { "lodash-es": "4.18.1", From 6e83488a78d9ddee35ad3463f0c820a84f61b7f9 Mon Sep 17 00:00:00 2001 From: Stephane Bouchet Date: Tue, 25 Aug 2026 10:07:16 -0500 Subject: [PATCH 4/4] use correct URL Signed-off-by: Stephane Bouchet --- .rebase/CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.rebase/CHANGELOG.md b/.rebase/CHANGELOG.md index 483a20cc0f2b..5fbf56a1500b 100644 --- a/.rebase/CHANGELOG.md +++ b/.rebase/CHANGELOG.md @@ -14,7 +14,7 @@ https://github.com/che-incubator/che-code/pull/791 --- #### @sbouchet -https://github.com/che-incubator/che-code/pull/NNN +https://github.com/che-incubator/che-code/pull/797 - code/extensions/mermaid-markdown-features/package.json - code/extensions/markdown-language-features/package.json