v10.9.5

mermaid-js/mermaidv10.9.5Nov 4, 2025by aloisklink

AI Summary

This patch release focuses on security updates, specifically backporting dependency fixes for CVE-2025-57347 and CVE-2025-26791 to the stable v10.x branch to ensure continued stability and security.

Key Highlights

Updated dagre-d3-es to 7.0.13 to fix CVE-2025-57347
Updated DOMPurify to avoid CVE-2025-26791

New Features

Security dependency updates

Full Release Notes

This release backports the update of the dependency dagre-d3-es to 7.0.13 for CVE-2025-57347 from [v11.12.1](https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.12.1).

We've also updated the v10.x branch to support newer versions of DOMPurify, cherry-picked from https://github.com/mermaid-js/mermaid/commit/fe3cffbb673a25b81989aacb06e5d0eda35326db, avoiding CVE-2025-26791.

**Full Changelog**: https://github.com/mermaid-js/mermaid/compare/v10.9.4...v10.9.5