v10.9.6

davidfowl/tallyv10.9.6May 11, 2026by aloisklink

AI Summary

A security-focused patch release that backports critical fixes from Mermaid v11.15.0 to address specific vulnerabilities and dependency warnings.

Key Highlights

Backports security fixes for Mermaid (CVE-2026-41150, CVE-2026-41148, CVE-2026-41149, CVE-2026-41159, CVE-2026-41907).
Fixes for gantt chart loops when excluding all dates.
Updates CSS styles handling to prevent unbalanced styles and block scope escapes.
Loosens uuid dependency range to allow v14 and silence warnings.

New Features

Security hardening for Mermaid diagrams
Fix for gantt chart iteration limits

Full Release Notes

Backports the following security fixes from [Mermaid v11.15.0][]:

- [CVE-2026-41150](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-6m6c-36f7-fhxh): **fix(gantt): limit loop if excluding all dates** (a59ea56174712ee5430dfd5bc877cb5151f501a6)
- [CVE-2026-41148](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-xcj9-5m2h-648r): **fix: prevent unbalanced CSS styles in classDefs** (8fead23c59166b7bab6a39eac81acebee2859102)
- [CVE-2026-41149](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-ghcm-xqfw-q4vr): **fix: create CSS styles using the CSSOM** (4e2d512bf5bf6f9de1a8f0a48da78dc4d09ac4f3)
- [CVE-2026-41159](https://github.com/mermaid-js/mermaid/security/advisories/GHSA-87f9-hvmw-gh4p): **fix: block stylis scope escape** (a9d9f0d8eb790349121508688cd338253fd80d76)
- CVE-2026-41907: **fix: loosen `uuid` dependency range to allow v14**
  We don't use this vulnerable code, but it allows users to silence this warning.
  (e8c70434520dd9226bd442f857970cd211067627)

And other dependency updates.

[Mermaid v11.15.0]: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.15.0

**Full Changelog**: https://github.com/mermaid-js/mermaid/compare/v10.9.5...v10.9.6