merman: upgrade library

Cargo.toml

@@ -28,10 +28,7 @@ term_size = "0.3.2"
 resvg = { version = "0.48.1", default-features = false, features = ["text", "system-fonts", "raster-images"] }
 unicode-width = "0.2.2"
 htmlentity = "1.3.2"
-merman = { version = "0.8.0-alpha.3", default-features = false, features = ["render", "ascii"] }
-# Pulled in directly only to enable label/URL sanitization, which strips external
-# resource references (e.g. file:// image hrefs) before the SVG reaches resvg.
-merman-core = { version = "0.8.0-alpha.3", default-features = false, features = ["full-sanitization"] }
+merman = { version = "0.8.0-alpha.5", default-features = false, features = ["svg", "ascii"] }
 
 [dev-dependencies]
 serde = { version = "1.0.229", features = ["derive"] }

src/lib.rs

@@ -1580,12 +1580,13 @@ impl StreamingParser {
         let (tx, rx) = std::sync::mpsc::channel();
         let source_clone = source.clone();
         std::thread::spawn(move || {
-            // Use the resvg-safe pipeline: Mermaid-parity SVG puts labels inside
+            // Use the resvg-compatible pipeline: Mermaid-parity SVG puts labels inside
             // <foreignObject> HTML for flowcharts, class/ER/state diagrams, mindmaps and
             // kanban. resvg does not implement foreignObject, so those labels would be
             // silently dropped. This pipeline converts HTML labels to native SVG <text>.
-            let result =
-                merman::render::HeadlessRenderer::new().render_svg_resvg_safe_sync(&source_clone);
+            let result = merman::svg::HeadlessRenderer::new()
+                .render_resvg_compatible_svg_sync(&source_clone)
+                .map(|opt| opt.map(|svg| svg.into_string()));
             // Ignore send errors — receiver may have timed out and been dropped
             let _ = tx.send(result);
         });

tests/unit.rs

@@ -1897,10 +1897,11 @@ mod mermaid_rendering {
             "stateDiagram-v2\n    [*] --> Still\n    Still --> Moving\n",
             "erDiagram\n    CUSTOMER ||--o{ ORDER : places\n",
         ] {
-            let svg = merman::render::HeadlessRenderer::new()
-                .render_svg_resvg_safe_sync(source)
+            let rendered = merman::svg::HeadlessRenderer::new()
+                .render_resvg_compatible_svg_sync(source)
                 .expect("render should succeed")
                 .expect("diagram type should be detected");
+            let svg = rendered.as_str();
             assert!(
                 !svg.contains("foreignObject"),
                 "resvg-safe SVG still contains foreignObject for source: {:?}",