From ae0e478267325488e6742923ce1179cf0c4e00bf Mon Sep 17 00:00:00 2001
From: Bill Mill <bill.mill@jellyfish.co>
Date: Mon, 10 Aug 2026 16:37:11 -0400
Subject: [PATCH] merman: upgrade library

---
 Cargo.toml    | 5 +----
 src/lib.rs    | 7 ++++---
 tests/unit.rs | 5 +++--
 3 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index f981f4b..048c2a8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -28,10 +28,7 @@ term_size = "0.3.2"
 resvg = { version = "0.48.1", default-features = false, features = ["text", "system-fonts", "raster-images"] }
 unicode-width = "0.2.2"
 htmlentity = "1.3.2"
-merman = { version = "0.8.0-alpha.3", default-features = false, features = ["render", "ascii"] }
-# Pulled in directly only to enable label/URL sanitization, which strips external
-# resource references (e.g. file:// image hrefs) before the SVG reaches resvg.
-merman-core = { version = "0.8.0-alpha.3", default-features = false, features = ["full-sanitization"] }
+merman = { version = "0.8.0-alpha.5", default-features = false, features = ["svg", "ascii"] }
 
 [dev-dependencies]
 serde = { version = "1.0.229", features = ["derive"] }
diff --git a/src/lib.rs b/src/lib.rs
index 5038fff..27b02a4 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -1580,12 +1580,13 @@ impl StreamingParser {
         let (tx, rx) = std::sync::mpsc::channel();
         let source_clone = source.clone();
         std::thread::spawn(move || {
-            // Use the resvg-safe pipeline: Mermaid-parity SVG puts labels inside
+            // Use the resvg-compatible pipeline: Mermaid-parity SVG puts labels inside
             // <foreignObject> HTML for flowcharts, class/ER/state diagrams, mindmaps and
             // kanban. resvg does not implement foreignObject, so those labels would be
             // silently dropped. This pipeline converts HTML labels to native SVG <text>.
-            let result =
-                merman::render::HeadlessRenderer::new().render_svg_resvg_safe_sync(&source_clone);
+            let result = merman::svg::HeadlessRenderer::new()
+                .render_resvg_compatible_svg_sync(&source_clone)
+                .map(|opt| opt.map(|svg| svg.into_string()));
             // Ignore send errors — receiver may have timed out and been dropped
             let _ = tx.send(result);
         });
diff --git a/tests/unit.rs b/tests/unit.rs
index 784b2c4..0eeefd3 100644
--- a/tests/unit.rs
+++ b/tests/unit.rs
@@ -1897,10 +1897,11 @@ mod mermaid_rendering {
             "stateDiagram-v2\n    [*] --> Still\n    Still --> Moving\n",
             "erDiagram\n    CUSTOMER ||--o{ ORDER : places\n",
         ] {
-            let svg = merman::render::HeadlessRenderer::new()
-                .render_svg_resvg_safe_sync(source)
+            let rendered = merman::svg::HeadlessRenderer::new()
+                .render_resvg_compatible_svg_sync(source)
                 .expect("render should succeed")
                 .expect("diagram type should be detected");
+            let svg = rendered.as_str();
             assert!(
                 !svg.contains("foreignObject"),
                 "resvg-safe SVG still contains foreignObject for source: {:?}",