v10.9.8

mermaid-js/mermaidv10.9.8Aug 4, 2026by aloisklink

AI Summary

This release backports critical security and bug fixes from the v11.16.1 branch, specifically addressing prototype pollution vulnerabilities and CSS compilation issues. It also introduces the deprecation of the `mermaidAPI.setConfig()` function while adding support for zero-width ranges in xycharts.

Key Highlights

Increased protections against prototype pollution
Fixed CSS sibling combinators in compileCSS
Xychart now supports zero-width x-axis ranges
Deprecated the `mermaidAPI.setConfig()` function

Full Release Notes

Backports the following fixes from [Mermaid v11.16.1][1].
    
 - GHSA-c4c3-pg64-4m4v
    - fix: increase protections against prototype pollution
    - deprecate: Deprecate the `mermaidAPI.setConfig()` function
 - GHSA-6x64-9x62-f2gx - fix: handle CSS sibling combinators in compileCSS
 - GHSA-2v8p-3f2j-5mp7 - fix(xychart): support zero-width x-axis ranges
    
Due to a publish error, v10.9.7 was skipped.

**Full Changelog**: https://github.com/mermaid-js/mermaid/compare/v10.9.6...v10.9.8

[1]: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1