v10.9.8

pbakaus/impeccablev10.9.8Aug 4, 2026by aloisklink

AI Summary

This patch release backports critical security and stability fixes from Mermaid v11.16.1 to version 10.9.8, addressing prototype pollution vulnerabilities and CSS rendering issues.

Key Highlights

Backported security fixes for prototype pollution (GHSA-c4c3-pg64-4m4v)
Fixed handling of CSS sibling combinators in compileCSS
Fixed xychart support for zero-width x-axis ranges
Deprecated mermaidAPI.setConfig() function

Breaking Changes

Deprecated mermaidAPI.setConfig() function

Full Release Notes

Backports the following fixes from [Mermaid v11.16.1][1].
    
 - GHSA-c4c3-pg64-4m4v
    - fix: increase protections against prototype pollution
    - deprecate: Deprecate the `mermaidAPI.setConfig()` function
 - GHSA-6x64-9x62-f2gx - fix: handle CSS sibling combinators in compileCSS
 - GHSA-2v8p-3f2j-5mp7 - fix(xychart): support zero-width x-axis ranges
    
Due to a publish error, v10.9.7 was skipped.

**Full Changelog**: https://github.com/mermaid-js/mermaid/compare/v10.9.6...v10.9.8

[1]: https://github.com/mermaid-js/mermaid/releases/tag/mermaid%4011.16.1