chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates by dependabot[bot] · Pull Request #6368 · simstudioai/sim

dependabot · 2026-08-07T04:00:17Z

Bumps the npm_and_yarn group with 2 updates in the /apps/sim directory: js-yaml and mermaid.

Updates js-yaml from 4.3.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

[backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

86e91b8 4.3.1 released
c3cc4b0 Backport quadratic complexity fix for !!omap
See full diff in compare view

Updates mermaid from 11.15.0 to 11.16.1

Release notes

Sourced from mermaid's releases.

mermaid@11.16.1

Patch Changes

#8022 12d472c Thanks @aloisklink! - fix: handle CSS sibling combinators in compileCSS

#8022 2cd6dcf Thanks @aloisklink! - fix: increase protections against prototype pollution

User-controlled input already has protections against prototype pollution.

Fixes: GHSA-c4c3-pg64-4m4v

#8022 99af3fc Thanks @aloisklink! - fix(architecture): use Maps and Sets to store groups/services

Services are now rendered in the order they are defined and more service IDs are now supported.

#8022 2cd6dcf Thanks @aloisklink! - deprecate: Deprecate the mermaidAPI.setConfig() function

Calling this function has no observable effect, as the next time a render() or parse() is called, the currentConfig is cleared.

#8022 630aa7e Thanks @aloisklink! - fix(xychart): support zero-width x-axis ranges

#8022 59b22fa Thanks @aloisklink! - fix(radar): limit number of ticks to 32

Setting a ticks value higher than this would only show 32 ticks.

mermaid@11.16.0

Minor Changes

#7535 ea1c48f Thanks @ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.

#7721 f45cc2c Thanks @notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams

#7550 f1f4d45 Thanks @DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots

#7527 b4d0442 Thanks @notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.

#7793 a6f097d Thanks @SSDWGG! - feat(er): support optional ER attribute types with a ? suffix

#7772 37f2e36 Thanks @devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#6270)

#7708 4e63e9d Thanks @txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.

#7760 05223be Thanks @ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice

#7251 216e4e9 Thanks @ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).

#7774 e5c75e6 Thanks @ngdaniels! - feat(xychart): enable rotate label on X-axis

... (truncated)

Commits

7ecca0c Version Packages (#8023)
95b1b9c docs: change mermaidAPI.setConfig() changeset (#8024)
acc69f1 Merge pull request #8022 from mermaid-js/release/11.16.1
eba7287 docs: point changesets to correct commit hashes
12d472c Merge commit from fork
2cd6dcf Merge commit from fork
630aa7e Merge commit from fork
59b22fa Merge commit from fork
99af3fc Merge commit from fork
2337f7e Merge branch 'test/improve-example.html' into release/11.16.1
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
You can disable automated security fix PRs for this repo from the Security Alerts page.

…dates Bumps the npm_and_yarn group with 2 updates in the /apps/sim directory: [js-yaml](https://github.com/nodeca/js-yaml) and [mermaid](https://github.com/mermaid-js/mermaid). Updates `js-yaml` from 4.3.0 to 4.3.1 - [Changelog](https://github.com/nodeca/js-yaml/blob/4.3.1/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.3.0...4.3.1) Updates `mermaid` from 11.15.0 to 11.16.1 - [Release notes](https://github.com/mermaid-js/mermaid/releases) - [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.15.0...mermaid@11.16.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.3.1 dependency-type: direct:production dependency-group: npm_and_yarn - dependency-name: mermaid dependency-version: 11.16.1 dependency-type: direct:production dependency-group: npm_and_yarn ... Signed-off-by: dependabot[bot] <support@github.com>

vercel · 2026-08-07T04:00:23Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 7, 2026 4:00am

cursor · 2026-08-07T04:00:29Z

PR Summary

Low Risk
Dependency-only version bumps with security patches; no app logic changes, though upgraded libraries handle user-controlled YAML and diagram input.

Overview
Updates two npm dependencies in apps/sim/package.json only—no application source changes.

js-yaml moves from 4.3.0 to 4.3.1, a patch that backports a security fix for quadratic complexity in !!omap duplicate key detection (relevant to YAML parsing in chunkers and file parsers).

mermaid moves from 11.15.0 to 11.16.1, bringing stronger prototype-pollution protections, CSS sibling combinator fixes in compileCSS, architecture diagram storage changes, and assorted diagram bugfixes from the 11.16.x line.

^{Reviewed by Cursor Bugbot for commit 6e08572. Bugbot is set up for automated code reviews on this repo. Configure here.}

cursor

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 6e08572. Configure here.}

cursor · 2026-08-07T04:02:35Z

    "lru-cache": "11.3.6",
    "mammoth": "^1.9.0",
-    "mermaid": "11.15.0",
+    "mermaid": "11.16.1",


Mermaid override blocks bump

High Severity

mermaid is raised to 11.16.1 here, but the root package.json and bun.lock overrides still pin mermaid to 11.15.0. Installs in this monorepo therefore keep resolving the older release, so prototype-pollution and other fixes advertised for 11.16.1 may not actually ship despite this bump.

^{Reviewed by Cursor Bugbot for commit 6e08572. Configure here.}

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 7, 2026

dependabot Bot requested a review from a team as a code owner August 7, 2026 04:00

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 7, 2026

vercel Bot temporarily deployed to Preview August 7, 2026 04:00 Inactive

cursor Bot reviewed Aug 7, 2026

View reviewed changes

Navigation Menu

Uh oh!

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates - #6368

chore(deps): bump the npm_and_yarn group across 1 directory with 2 updates#6368
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/apps/sim/npm_and_yarn-ef57581f01

dependabot Bot commented on behalf of github Aug 7, 2026

Uh oh!

vercel Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Aug 7, 2026 •

edited

Loading

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Aug 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Aug 7, 2026

4.3.1 - 2026-07-31

Security

mermaid@11.16.1

Patch Changes

mermaid@11.16.0

Minor Changes

Uh oh!

vercel Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Aug 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Aug 7, 2026

Choose a reason for hiding this comment

Mermaid override blocks bump

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

vercel Bot commented Aug 7, 2026 •

edited

Loading

cursor Bot commented Aug 7, 2026 •

edited

Loading