Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Upgrade Mermaid to 11.17.2 (fixes six advisories in 11.12.x)

Open Beginner friendly
  • Is something wrong?
#15,042 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
60/100
Issue type
Refactor
Clarity
Clearly specified
Activity status
Active
Tech stack
javascript
Domain
frontend, security

Research direction

Start with dev-docs/upgrade-dependencies.md, which describes the vendoring steps. The bundles to replace are mermaid.js and mermaid.min.js in src/resources/formats/html/mermaid/, taken from the unpkg 11.17.2 dist. Render a page with a classDiagram, a C4 diagram and a Gantt chart before and after to check the new renderer. Done means both files are updated and those diagrams still render.

Written by the indexing model from the issue text.

Description

quarto-cli vendors Mermaid 11.12.0 in src/resources/formats/html/mermaid/. Every rendered HTML page that uses Mermaid ships it. Six advisories affect all 11.12.x releases, and they're fixed in 11.14.1 or 11.16.1:

  • GHSA-c4c3-pg64-4m4v
  • GHSA-6x64-9x62-f2gx
  • GHSA-87f9-hvmw-gh4p
  • GHSA-xcj9-5m2h-648r
  • GHSA-ghcm-xqfw-q4vr
  • GHSA-6m6c-36f7-fhxh

They cover config prototype pollution, CSS/classDef and HTML injection, and an infinite loop in Gantt charts. 11.17.2 has none of them.

Proposal: bump to 11.17.2. That would match the VS Code extension, which moved its notebook renderer and its diagram preview to 11.17.2 in quarto-dev/quarto#1189. Both now run ahead of the CLI's Mermaid version.

As in dev-docs/upgrade-dependencies.md, get dist/mermaid.js and dist/mermaid.min.js from https://unpkg.com/[email protected]/ and copy them into src/resources/formats/html/mermaid/.

Things to know about 11.13 to 11.17:

  • These releases mostly add syntax (new diagram types and shapes, extra directives), so existing diagrams should keep working.
  • One visible change: in 11.17, classDiagram and C4 diagrams moved to Mermaid's unified (v2) renderer, so they'll look somewhat different.
  • 11.17 builds no longer embed name:"mermaid",version:"…" in the bundle. Anything that sniffs the version from the file needs another pattern; the extension's test now matches the renderer.draw(…, "X.Y.Z" literal.
  • mermaid.min.js grows from 2.75 MB to 3.57 MB.
Dominant language
JavaScript
Stars
6.1k
Forks
466
Avg merge
20h 18m
Merged PRs (30d)
74

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from quarto-dev/quarto-cli

All issues in quarto-dev/quarto-cli

Similar issues

More JavaScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.