chore(deps): upgrade Mermaid to 12.1.0 with stable diagram styling

[dependabot]

What Problem This Solves

Upgrades the docs diagram renderer from Mermaid 11.17.2 to 12.1.0 while preserving the site's existing Dagre layout, classic look, and custom base theme.

User Impact

Diagram defaults remain stable. The browser floor rises to Safari/iOS 17.4, Chromium 121, and Firefox 123. The maintainer explicitly accepts the estimated September 2026 Safari 15.4–17.3 usage impact: 1.03% worldwide and 1.86% in the US. These are public browser-usage cohorts, not measured docs visitors; see the impact decision.

Why This Change Was Made

Mermaid 12 changes layout and styling defaults. The canonical renderer now selects Dagre/classic explicitly; both inline and expanded diagrams continue through the same initialization path. The lockfile retains current main's other dependency updates and the original Dependabot ancestry.

Evidence

• Adds a state-diagram fixture alongside the existing flowchart, sequence, and invalid-input fixtures.
• Shares the existing overlay/focus/history/Escape/error-cleanup checks between the full Chromium suite and a focused WebKit run. Adds actual SVG labels, theme rerendering, and client-side page navigation checks.
• Local JavaScript syntax and whitespace checks pass. Independent P0–P3 review is scoped-clean for head 0484b34c96f4b27e88615bbb538db81cd2325dd2 (no actionable findings or suspected credentials). All five checks are green for that exact head. Full hosted CI passed dependency installation, helper tests, Worker dry run, full site build, shell smoke, the full Chromium visual suite, focused Mermaid tests in WebKit, and community invitation checks in both browsers. Actual diagram SVGs are distinguished from expand-control icons; every overlay check waits for rendering, and error cleanup also checks render IDs because Mermaid 12 changed its parser-error text.
• Runtime source: +1 net line for explicit appearance settings and their contract comment. Browser tests: +77 net lines; fixture: +7; CI: +3. No new runtime branches or public config surface.

The maintainer explicitly authorized the automatic R2 docs deployment associated with squash-merging this qualified head. This approval is scoped to this docs deployment; tags, package publication, and other releases remain unauthorized.

Original Dependabot dependency details

Bumps mermaid from 11.17.2 to 12.1.0.

Release notes

Sourced from mermaid's releases.

mermaid@12.1.0

Minor Changes

• #8303 9140716 Thanks @​filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

• #8250 fd4f5f2 Thanks @​kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current behaviour, and descending mirrors every row so it reads from that row's highest bit down to its lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram between the two conventions only means changing bitOrder.

Patch Changes

• #8330 50c9e55 Thanks @​ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

• #8259 4c90f5c Thanks @​afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

  participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error, even though the plain form without a config object tolerates trailing whitespace just fine.

• #8339 c7fa1a5 Thanks @​ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

• #8334 d67331d Thanks @​ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

• #8344 99a050b Thanks @​pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

• #8276 3101c7d Thanks @​mir-ashiq! - fix(error): show the actual error message in the error diagram

  When a diagram fails to parse, the error diagram now draws the real error message below the "Syntax error in text" headline, wrapped to at most four lines. Hosts that only show the SVG (GitHub, GitLab, Obsidian, exported images) no longer hide what actually went wrong, e.g. that the flowchart edge limit was exceeded and maxEdges needs raising via mermaid.initialize.

• #8296 aa29345 Thanks @​pentaoa! - fix: preserve explicit source relations on event modeling reset frames

• #8297 967bbde Thanks @​pentaoa! - fix: reject duplicate event modeling frame IDs before rendering

• #8337 147f343 Thanks @​knsv-bot! - fix: a flowchart that declares the same subgraph id more than once now renders as one merged subgraph with the ELK layout instead of producing NaN geometry. Classes and view: collapsed set on a repeated subgraph now apply to it, whichever declaration they follow.

• #8203 40ef7b4 Thanks @​MFA-G! - perf(frontmatter): replace the quadratic front matter regex on hot paths

  frontMatterRegex backtracks polynomially on whitespace-heavy input, so a diagram well inside the default maxTextSize could stall parsing for over a second. detectType and extractFrontMatter now use a linear scanner that matches the regex result exactly, leaving no document stripped differently.

• #8254 351d7d2 Thanks @​galshir! - fix: warn when a gantt task references an unknown after/until task id, or when its end value is neither a valid date nor a valid duration

• #8249 b657a2c Thanks @​mir-ashiq! - fix(sequence): allow hyphenated actor and participant names when a config object is attached

... (truncated)

Commits

• 21f72f0 Merge pull request #8360 from mermaid-js/changeset-release/master
• 3f89f7b Version Packages
• 4ef0218 Merge pull request #8358 from mermaid-js/release/12.0.1
• f45c691 Fix error from build docs
• d9cb282 Fix label overlap bug
• 47fffa0 Merge pull request #8297 from pentaoa/fix/eventmodeling-duplicate-frame-ids
• 12c280e Merge develop and preserve eventmodeling regression tests
• c0f7052 Merge pull request #8296 from pentaoa/fix/eventmodeling-reset-explicit-relations
• 4f6ac96 Merge pull request #8345 from mermaid-js/bug/8283_xychart-legend-clip-title-h...
• 679093a Merge pull request #8344 from mermaid-js/pebr/issue-8292-elk-label
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[vincentkoc]

Decision: proceed with the Mermaid 12 uplift. Maintainer accepts the quantified browser-support tradeoff below. The PR is reopened for a narrow compatibility change, independent review, and fresh full CI before merge.

Public impact

Can I Use’s September 2026 usage data, frozen at commit 50f75b62d4a625a44ab9588890d96f3f7f514d79, puts Safari/iOS versions >=15.4 and <17.4 at:

Browser family	Worldwide usage	US usage
Desktop Safari	0.37650%	0.82134%
iOS Safari	0.65315%	1.04019%
Combined	1.02965%	1.86153%

Calculation: sum the existing version buckets within that interval; percentages are of overall browser usage, not percentages of Safari users. These are public usage proxies, not this site’s visitor analytics. They quantify this Apple-browser cohort only, not every potential Chromium/Firefox compatibility loss.

Sources (month 2026-09, accessed by the publisher 2026-10-05):

• https://github.com/Fyrd/caniuse/blob/50f75b62d4a625a44ab9588890d96f3f7f514d79/region-usage-json/alt-ww.json
• https://github.com/Fyrd/caniuse/blob/50f75b62d4a625a44ab9588890d96f3f7f514d79/region-usage-json/US.json

Mermaid 12 intentionally requires ES2024/Safari 17.4+; see mermaid-js/mermaid@33442fd and https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4012.0.0. Docs copies the published browser bundle unchanged (scripts/docs-site/build.mjs:874–880); it does not transpile/polyfill this difference. If import/render fails, the existing owner shows “Diagram could not be rendered” and source code instead of the diagram (site-js.mjs:232).

Benefit versus cost

The public 12.1.0 release adds ELK/diagram improvements, parser fixes and bundled dependency cleanup: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4012.1.0. No existing docs failure requiring these changes was established. ELK/neo defaults also change current diagram geometry/appearance; preserving Dagre/classic would address that visual change but would not restore older browser support.

Security was checked rather than assumed: the public GitHub advisory query for mermaid@11.17.2 returned no direct package advisory on October 16, 2026. The old prebuilt parser does embed Lodash 4.17.23 modules, but inspection of its published source map found none of template.js, unset.js, omit.js, or _baseUnset.js, the modules implicated in the reviewed Lodash advisories. This establishes a dependency-hygiene benefit from 12.1.0, not a demonstrated exploitable docs path. It is not a blanket security-clean claim. The inspected docs lock already resolves separately installed Lodash to 4.18.1; updating that lock does not rewrite Mermaid’s prebuilt bundle.

Named follow-up: reassess Mermaid’s vendored dependency hygiene separately if a reachable advisory emerges; this upgrade is not evidence that every copied dependency is current. No claim is made that 11.x has an upstream LTS/EOL guarantee.

The older missing-Swedish-page CI failure is unrelated. Acceptance now explicitly includes the public browser-support cost. Implementation will preserve the existing Dagre/classic/base presentation, prove representative rendering and lifecycle behavior in Chromium/WebKit, and require fresh full CI on the final head. No release, tag, package publishing or manual deployment is authorized. No major-version ignore rule was added.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.