@mermaid-js/layout-elk@1.0.1 @mermaid-js/parser@2.0.1
hkjarral/AVA-AI-Voice-Agent-for-AsteriskOct 2, 2026 → Oct 2, 20260 days between releases
What's New
The newer release is a different package (@mermaid-js/parser), not a successor to @mermaid-js/layout-elk, and its only change is a langium/chevrotain upgrade that drops vulnerable lodash-es.
Breaking Changes
- The parser now builds on langium 4.4 and chevrotain 13, so any custom grammar or parser extension pinned to older langium/chevrotain APIs may need adjustment.
Improvements
- Parser dependencies moved to langium 4.4 and chevrotain 13.
- Bundles no longer ship lodash-es@4.17.23, removing a known vulnerable package.
- Security posture improved by eliminating the vulnerable transitive dependency.
Bug Fixes
- Addressed the lodash-es vulnerability exposure in published parser bundles.
Upgrade Notes
These two entries are separate Mermaid packages (@mermaid-js/layout-elk vs @mermaid-js/parser), so there is no direct version-to-version upgrade path between them; treat them as independent dependency bumps. If you consume the parser, re-test custom langium/chevrotain integrations against the new major versions and confirm lodash-es is absent from your bundle. The layout-elk patch only affects class-diagram cardinality label placement under ELK.
The Two Releases
@mermaid-js/layout-elk@1.0.1
Oct 2, 2026· 20 days ago
A patch release aligning with Mermaid 12.1.0 and fixing specific layout issues with class diagrams using the ELK engine.
Full release notes@mermaid-js/parser@2.0.1
Oct 2, 2026· 20 days ago
A patch release focusing on dependency upgrades to improve security by removing a known vulnerable package.
Full release notes