chore(deps): bump dompurify and mermaid in /site #3696
Conversation
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?s=60&v=4){kind=small}
dependabot
bot
added
dependencies
javascript
✅ Deploy Preview for zarf-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
|
Before merging this we'll have to make some updates to our mermaid diagrams. It looks like a box referencing itself causes things to look wonky after this update Currently it looks like |
Bumps [dompurify](https://github.com/cure53/DOMPurify) to 3.2.5 and updates ancestor dependency [mermaid](https://github.com/mermaid-js/mermaid). These dependencies need to be updated together. Updates `dompurify` from 3.1.6 to 3.2.5 - [Release notes](https://github.com/cure53/DOMPurify/releases) - [Commits](cure53/DOMPurify@3.1.6...3.2.5) Updates `mermaid` from 10.9.3 to 11.6.0 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Changelog](https://github.com/mermaid-js/mermaid/blob/develop/CHANGELOG.md) - [Commits](https://github.com/mermaid-js/mermaid/compare/[email protected]) --- updated-dependencies: - dependency-name: dompurify dependency-version: 3.2.5 dependency-type: indirect - dependency-name: mermaid dependency-version: 11.6.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
dependabot
bot
force-pushed
the
dependabot/npm_and_yarn/site/multi-7ecc50d159
branch
from
c4c0397 to
8c27221
Compare
Codecov ReportAll modified and coverable lines are covered by tests ✅ 🚀 New features to boost your workflow:
|
|
The self-edge/loop is a known constraint of the changes included in v11+ of Mermaid. Between v10.x and v11.x the switch (and upgrade) of the layout engine (dagre → dagre/elk, plus internal refactors) changed how ports and bend points are chosen. The algorithm now aggressively avoids node overlaps and minimizes crossings by routing the loop all the way around, yielding those giant, erratic curves instead of a tidy arc. Given that this is a known issue and that it results in a security finding in the repository (Note - not against the go code) - I would suggest we create an issue to track this irregularity until it is resolved and/or find another diagram option to replace the current diagrams. |
Bumps dompurify to 3.2.5 and updates ancestor dependency mermaid. These dependencies need to be updated together.
Updates
dompurifyfrom 3.1.6 to 3.2.5Release notes
Sourced from dompurify's releases.
Commits
7806004Merge pull request #1082 from cure53/mainf14c22fchore: Preparing 3.2.5 releasec69d7a8Merge pull request #1080 from hhk-png/mainfce40b5chore: for lint59e8664Merge branch 'cure53:main' into maine62e3effix: Using ALLOWED_URI_REGEXP with the 'g' flag leads to incorrect resultsb428788Update README.md72c00dbMerge branch 'main' of github.com:cure53/DOMPurify49882dctest: Added Node 23.x to tested runtimes, removed Node 17.x2e5fd64Merge pull request #1078 from reduckted/fix-sourcemapsUpdates
mermaidfrom 10.9.3 to 11.6.0Release notes
Sourced from mermaid's releases.
... (truncated)
Commits
7b20839Merge pull request #6412 from mermaid-js/changeset-release/masterbb9210cVersion Packages16d9b63Add missing changeset for requirement diagram fixbf3370fMerge pull request #6409 from mermaid-js/release/11.6.09f9091eUpdate mermaid version palceholderd1b1a67Merge pull request #6410 from aloisklink/test/fix-cypress-on-nodejs-v20.19.0ac625bdtest(e2e): fix Cypress config for Node.JS v20.19.040b85c3Merge pull request #6408 from mermaid-js/fix/6193-curve-interpolationf8e329fMerge branch 'develop' into fix/6193-curve-interpolation9b9cec9Merge pull request #6386 from bollwyvl/patch-5Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot mergewill merge this PR after your CI passes on it@dependabot squash and mergewill squash and merge this PR after your CI passes on it@dependabot cancel mergewill cancel a previously requested merge and block automerging@dependabot reopenwill reopen this PR if it is closed@dependabot closewill close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)You can disable automated security fix PRs for this repo from the Security Alerts page.