Skip to content

Update mermaid to 11.17.2 [SECURITY] - #2738

Merged
MarcusSorealheis merged 1 commit into
TraceMachina:mainfrom
MarcusSorealheis:fix-vuln-GHSA-2v8p-3f2j-5mp7
Sep 5, 2026
Merged

Update mermaid to 11.17.2 [SECURITY]#2738
MarcusSorealheis merged 1 commit into
TraceMachina:mainfrom
MarcusSorealheis:fix-vuln-GHSA-2v8p-3f2j-5mp7

Conversation

@MarcusSorealheis

@MarcusSorealheis MarcusSorealheis commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

What and why

Bumps mermaid in the docs app from 11.15.0 to 11.17.2 (range ^11.4.1
to ^11.16.1) to clear five advisories the OpenSSF Scorecard
vulnerabilities check flags on main, all fixed in 11.16.1:

The lockfile picks up mermaid's own dependency moves: @mermaid-js/parser
1.1.1 to 1.2.1, cytoscape 3.33.4 to 3.34.2, and two new small packages
(fastdom, strictdom). Its dompurify range resolves to the 3.4.14
already on main from #2735.

How was this verified?

Risk

Low. Minor releases of a client-side diagram renderer used only by the docs
site. If a diagram type changed its rendering it would show on the docs
preview deploy; nothing outside web/apps/docs is touched.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

This change is Reviewable

@vercel

vercel Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
nativelink Ready Ready Preview Sep 5, 2026 5:54pm UTC
nativelink-aidm Ready Ready Preview Sep 5, 2026 5:54pm UTC

Request Review

@MarcusSorealheis @claude
Update mermaid to 11.17.2 [SECURITY]
c3f687c 
Fixes GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx,
GHSA-c4c3-pg64-4m4v and GHSA-rhh3-jpg6-66xh in the docs app's mermaid
dependency (range ^11.4.1 -> ^11.16.1).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE
@MarcusSorealheis
MarcusSorealheis force-pushed the fix-vuln-GHSA-2v8p-3f2j-5mp7 branch from 06df1d3 to c3f687c Compare September 5, 2026 17:53
@MarcusSorealheis
MarcusSorealheis merged commit e6d3796 into TraceMachina:main Sep 5, 2026
13 of 15 checks passed
modernmedici added a commit to modernmedici/nativelink that referenced this pull request Sep 6, 2026
@modernmedici @MarcusSorealheis
@cursoragent @palfrey @amankrx @claude
web: fix company Media kit Download 404 (#4)
894d3a5 
* Introduce Rules Omniverse (TraceMachina#2720)

* web: point Media kit Download at the shared Drive folder

The company CTA was an incomplete folders/ URL and 404ed. Restore the
folder id from the previous company page so Download opens the kit.

Fixes TRA-548.

Co-authored-by: Sumon Sadhu <sumon.sadhu@gmail.com>

* Cursor/menlo security case study 6c68 (TraceMachina#2721)

* docs: add Menlo Security Chromium case study

Publish the approved external Menlo Security case study on Resources
and style markdown tables in blog article prose so the results grid
renders as a readable before/after comparison.

* docs: use the Menlo Security wordmark on the case study

Host the official site wordmark and point the post's Open Graph image
at it, matching how CIQ and LastMile AI attach a customer logo.

* docs: add Menlo hybrid Kubernetes topology figure

Place the architecture slide under The Architecture so the hybrid
control plane, local CAS, and elastic worker pools are visible next
to the topology they describe.

* docs: add Menlo Chromium build-time comparison figure

Place the 4.5h to 25m lockup under The Results and use it as the
Open Graph image so the social preview carries the same claim.

* docs: enlarge the opening case-study pull quote

Render blockquotes as a large first paragraph with a smaller
attribution line so Christopher Staite's Chromium quote leads the
Menlo article at pull-quote size rather than body type.

* docs: make blog pull quotes a guaranteed larger size

Style the opening quote with explicit CSS on the post page so the
Staite line reads at 1.75–2rem instead of body type, with a smaller
attribution under it.

* docs: redesign blog prose for the Menlo case study

Treat the article as long-form, not default markdown: a spec-sheet
glance list, pull quote with mono attribution, metric table, captioned
figures, and a closing card — using the Technical Warmth type and
color system so the body actually reads.

* docs: make blog list markers clearly brand purple

Default discs were winning the eye on unordered lists. Force
list-style off on items and use a 7px brand dot so Challenge
bullets match the numbered rollout markers.

* docs: point the Menlo case study CTA at enterprise.nativelink.com

The closing get-started link went to app.nativelink.com; send readers
to the enterprise site instead.

* docs: add glance-row icons to the Menlo case study

Put a small brand-tint icon on each At a Glance row so the spec
sheet scans as Industry, Scale, Challenge, Solution, Result, and
Adoption instead of a wall of labels.

* docs: shrink glance icons so the spec sheet columns stay put

Drop the tinted 26px tiles. Keep 11px brand marks in the existing
row padding so Industry–Adoption still line up as before.

* docs: add a Company header with the Menlo wordmark

Lead the At a Glance spec sheet with a Company row so the table
opens as COMPANY plus the Menlo Security logo.

* docs: keep glance icons in-flow and add a Menlo company card

Stop absolutely positioning row icons so they stay aligned with labels
from desktop through phone. Replace the oversized wordmark with a compact
company card: hexagonal mark, Menlo Security name, and menlosecurity.com.

* docs: use the official Menlo wordmark in the company card

Replace the cropped hexagonal O with Menlo Security's actual wordmark,
kept small on a white logo tile. The card still spells out Menlo Security
and links to menlosecurity.com.

* docs: set the Menlo company cell in the glance table

Drop the nested chip and white logo tile so Company reads as another
spec-sheet row: official wordmark, Menlo Security, and the URL using
the same type and colors as the rest of the table.

* docs: add a Company icon and even out glance-table spacing

Give Company the same in-flow label icon as the other spec-sheet rows,
and tighten column gap, label gap, and the wordmark-to-name spacing so
the first cell sits on the same rhythm as Industry through Adoption.

* docs: scale the Menlo wordmark to the glance value stack

* docs: tighten glance-table spacing and keep Company on the same grid

Give Company a building icon like the other labels, top-align the
wordmark lockup, and pull the label column in so icons sit with their
copy instead of floating in a wide gutter.

* docs: give stacked glance rows a little more breathing room

* docs: center figure captions and number them Fig. 1 and Fig. 2

Label the build-time comparison and the hybrid topology with numbered
captions, and center the sentences under each image.

* docs: lock the Menlo wordmark to the name and URL

Size the logo to the two-line type stack and space the name and URL
against the top and bottom of the wordmark so MENLO lines up with
Menlo Security and SECURITY lines up with the link.

* chore: ignore JPEG assets in the marketing site

Stop tracking the Menlo case-study photos and ignore *.jpg under
web/apps/web so those binaries stay local.

* chore: clear pre-commit failures on the Menlo case study

Add a trailing newline to blog-prose CSS, stop tracking marketing
binaries (JPEG and PNG), and fix Vale: keep Staite and Cybersecurity
in the vocab, replace easily/configurability/Uncached in the copy.

* docs: make the Menlo case study read more naturally

Drop em dashes and rewrite the post in a more spoken register, without changing the facts.

* chore: add trailing newline to the Menlo wordmark SVG

The end-of-file-fixer hook requires files to end with a newline.

---------

Co-authored-by: Marcus Eagan <marcuseagan@gmail.com>

* Upgrade rules_rs to 0.0.108 to fix zlib issues (TraceMachina#2724)

* Upgrade to Rust 1.97.1 (TraceMachina#2718)

* Upgrade flake for newer Rust version

* Use upstream cargo-llvm-cov

* Remove unused async in evicting_map

* Fix various sanitizer build issues

* Fix complaint from unused_async_trait_impl

* Lots of new linter issues

* Improve asserts on is_empty

As per https://rust-lang.github.io/rust-clippy/main/index.html#assert_is_empty

* Clarify lib_tests failures

* More version message changes and lint fixes

* More async reductions

* Even more clippy fixes

* Cope with nightly-only lints

* Upgrade scorecard action to 2.4.4 (TraceMachina#2725)

* docs: track Menlo case-study figures under public/assets (TraceMachina#2723)

Move the wordmark and figure paths off /case-studies, stop ignoring
JPEGs on the marketing site, and allow these two figures through
forbid-binary-files so they clone and render.

* Retire queued actions no client is waiting on (TraceMachina#2726)

* Sweep queued actions no client is waiting on

* Only let a client's subscriber write the client keepalive

* Expire the client keepalive key

* Stop a refused update from leaving an empty record behind

* Update Rust crate event-listener to 5.4.2 [SECURITY] (TraceMachina#2731)

* Update Rust crate h2 to 0.4.19 [SECURITY] (TraceMachina#2732)

* Update esbuild to 0.28.2 [SECURITY] (TraceMachina#2736)

Fixes GHSA-g7r4-m6w7-qqqr (arbitrary file read from the esbuild dev
server on Windows, 0.27.3 through 0.28.0) in the esbuild copy that
fumadocs-mdx pulls into the docs app. Lockfile-only change.


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* Update nanoid to 3.3.18 [SECURITY] (TraceMachina#2739)

Fixes GHSA-28wg-ghj8-5hjv and GHSA-2v37-7h3g-55p8 (generators looping
indefinitely on negative or zero sizes) in the nanoid copy that postcss
pulls into both web apps. Lockfile-only change.


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* Update dompurify to 3.4.14 [SECURITY] (TraceMachina#2735)

* Update js-yaml to 4.3.2 [SECURITY] (TraceMachina#2737)

* Update Next.js to 16.2.12 [SECURITY] (TraceMachina#2733)

* Update mermaid to 11.17.2 [SECURITY] (TraceMachina#2738)

Fixes GHSA-2v8p-3f2j-5mp7, GHSA-3rrr-jr9j-h3q3, GHSA-6x64-9x62-f2gx,
GHSA-c4c3-pg64-4m4v and GHSA-rhh3-jpg6-66xh in the docs app's mermaid
dependency (range ^11.4.1 -> ^11.16.1).


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

* Update postcss to 8.5.28 [SECURITY] (TraceMachina#2740)

Fixes GHSA-6g55-p6wh-862q, GHSA-fxqj-rqcc-2cmp, GHSA-qx2v-qp2m-jg93 and
GHSA-r28c-9q8g-f849 in the postcss copy that @tailwindcss/postcss pulls
into both web apps. Bumps nanoid to 3.3.18 as postcss now requires it.
Lockfile-only change.


Claude-Session: https://claude.ai/code/session_01RW4DfubnMqK4UXHmG1J4vE

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Marcus Eagan <marcuseagan@gmail.com>
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Tom Parker-Shemilt <tom@tracemachina.com>
Co-authored-by: Aman Kumar <aman@tracemachina.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@amankrx amankrx amankrx approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@MarcusSorealheis @amankrx