[dependabot]

Bumps the bun group with 29 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	0.100.1	1.3.0
@codemirror/autocomplete	6.20.2	6.20.4
@codemirror/commands	6.10.3	6.11.1
@codemirror/lang-html	6.4.11	6.4.12
@codemirror/lang-markdown	6.5.0	6.5.2
@codemirror/search	6.7.0	6.7.2
@codemirror/state	6.7.1	6.7.6
@codemirror/view	6.43.6	6.43.15
@lezer/highlight	1.2.3	1.2.5
@openai/codex	0.164.0	0.166.0
diff	8.0.4	9.0.0
entities	7.0.1	9.0.0
highlight.js	11.11.1	11.12.0
katex	0.19.0	0.19.1
marked	18.0.3	18.1.2
mermaid	11.16.1	12.2.0
pg	8.23.0	8.23.1
@types/pg	8.21.0	8.23.1
playwright-core	1.62.1	1.64.1
react	19.2.6	19.3.1
@types/react	19.2.17	19.3.0
react-dom	19.2.6	19.3.1
@types/react-dom	19.2.3	19.3.0
@types/bun	1.3.14	1.4.4
@types/pg	8.21.0	8.23.1
@types/react	19.2.17	19.3.0
@types/react-dom	19.2.3	19.3.0
eslint	10.3.0	10.14.0
globals	17.6.0	17.14.0
prettier	3.8.3	3.9.10
typescript	6.0.3	7.0.2
typescript-eslint	8.64.0	8.72.1

Updates @anthropic-ai/sdk from 0.100.1 to 1.3.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v1.3.0

Features

• api: add Claude Tag endpoints for Claude Enterprise organizations

Bug Fixes

• client: link the long-request error messages to the SDK documentation

Chores

• client: stop sending query params hardcoded in endpoint paths
• docs: improve the descriptions of the code execution tool and its encrypted results
• docs: reword work queue, skill and external key descriptions
• docs: update descriptions of the per-user usage and cost reports
• internal: carry endpoint path query params to the request layer
• internal: check the repository by owner and public name in workflows
• internal: read the beta route qualifier instead of the beta=true query
• internal: remove preview build upload from CI
• internal: stop expecting the beta query param in tests

Documentation

• update the README and the example request

sdk-v1.2.0

Features

• api: add support for message threads
• api: add usage and cost reports by dimension, mark older reports legacy

Bug Fixes

• tools: copy the messages a tool runner is created with again
• tools: restore what the tool runner does after setMessagesParams() or pushMessages() in the loop body

Chores

• docs: clarify plugin content scan and validation descriptions
• docs: clarify plugin served_version_pinned and updated_at
• docs: fix usage and cost report examples and ending_at docs
• docs: rate limit model lists vary by organization and workspace
• internal: rename the version manifest to .version-manifest.json
• tests: fix a retry count header test that could never fail

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

1.3.0 (2026-10-23)

Features

• api: add Claude Tag endpoints for Claude Enterprise organizations

Bug Fixes

• client: link the long-request error messages to the SDK documentation

Chores

• client: stop sending query params hardcoded in endpoint paths
• docs: improve the descriptions of the code execution tool and its encrypted results
• docs: reword work queue, skill and external key descriptions
• docs: update descriptions of the per-user usage and cost reports
• internal: carry endpoint path query params to the request layer
• internal: check the repository by owner and public name in workflows
• internal: read the beta route qualifier instead of the beta=true query
• internal: remove preview build upload from CI
• internal: stop expecting the beta query param in tests

Documentation

• update the README and the example request

1.2.0 (2026-10-23)

Features

• api: add support for message threads
• api: add usage and cost reports by dimension, mark older reports legacy

Bug Fixes

• tools: copy the messages a tool runner is created with again
• tools: restore what the tool runner does after setMessagesParams() or pushMessages() in the loop body

Chores

• docs: clarify plugin content scan and validation descriptions
• docs: clarify plugin served_version_pinned and updated_at
• docs: fix usage and cost report examples and ending_at docs
• docs: rate limit model lists vary by organization and workspace
• internal: rename the version manifest to .version-manifest.json

... (truncated)

Commits

• cb5fba4 release: 1.3.0, packages/aws-sdk 1.1.1, packages/google-cloud-sdk 1.1.1
• 7a9f234 Merge pull request #995 from anthropics/synced/published
• 62ac1cb feat(api): add Claude Tag endpoints for Claude Enterprise organizations
• 2a3124c chore(internal): remove preview build upload from CI (#1001)
• 7e6e74e chore(internal): stop expecting the beta query param in tests (#1004)
• 50572e0 chore(docs): improve the descriptions of the code execution tool and its encr...
• 4771e93 docs: update the README and the example request
• 5c5fb00 fix(client): link the long-request error messages to the SDK documentation (#...
• ea1e87c chore: tidy internal comments (#1000)
• 957beba chore(docs): reword work queue, skill and external key descriptions
• Additional commits viewable in compare view

Updates @codemirror/autocomplete from 6.20.2 to 6.20.4

Commits

• See full diff in compare view

Updates @codemirror/commands from 6.10.3 to 6.11.1

Commits

• See full diff in compare view

Updates @codemirror/lang-html from 6.4.11 to 6.4.12

Commits

• See full diff in compare view

Updates @codemirror/lang-markdown from 6.5.0 to 6.5.2

Commits

• See full diff in compare view

Updates @codemirror/search from 6.7.0 to 6.7.2

Commits

• See full diff in compare view

Updates @codemirror/state from 6.7.1 to 6.7.6

Commits

• See full diff in compare view

Updates @codemirror/view from 6.43.6 to 6.43.15

Commits

• See full diff in compare view

Updates @lezer/highlight from 1.2.3 to 1.2.5

Commits

• See full diff in compare view

Updates @openai/codex from 0.164.0 to 0.166.0
Updates diff from 8.0.4 to 9.0.0

Changelog

Sourced from diff's changelog.

9.0.0

(All changes part of PR #672.)

• ES5 support is dropped. parsePatch now uses TextDecoder and Uint8Array, which are not available in ES5, and TypeScript is now compiled with the "es6" target. From now on, I intend to freely use any features that are deemed "Widely available" by Baseline. Users who need ES5 support should stick to version 8.

• C-style quoted strings in filename headers are now properly supported.

  When the name of either the old or new file in a patch contains "special characters", both GNU diff and Git quote the filename in the patch's headers and escape special characters using the same escape sequences that are used in string literals in C, including octal escapes for all non-ASCII characters. Previously, jsdiff had very little support for this; parsePatch would remove the quotes, and unescape any escaped backslashes, but would not unescape other escape sequences. formatPatch, meanwhile, did not quote or escape special characters at all.

  Now, parsePatch parses all the possible escape sequences that GNU diff (or Git) ever output, and formatPatch quotes and escapes filenames containing special characters in the same way GNU diff does.

• formatPatch now omits file headers when oldFileName or newFileName in the provided patch object are undefined, regardless of the headerOptions parameter. (Previously, it would treat the absence of oldFileName or newFileName as indicating the filename was the word "undefined" and emit headers --- undefined / +++ undefined.)

• formatPatch no longer outputs trailing tab characters at the end of ---/+++ headers.

  Previously, if formatPatch was passed a patch object to serialize that had empty strings for the oldHeader or newHeader property, it would include a trailing tab character after the filename in the --- and/or +++ file header. Now, this scenario is treated the same as when oldHeader/newHeader is undefined - i.e. the trailing tab is omitted.

• formatPatch no longer mutates its input when serializing a patch containing a hunk where either the old or new content contained zero lines. (Such a hunk occurs only when the hunk has no context lines and represents a pure insertion or pure deletion, which for instance will occur whenever one of the two files being diffed is completely empty.) Previously formatPatch would provide the correct output but also mutate the oldLines or newLines property on the hunk, changing the meaning of the underlying patch.

• Git-style patches are now supported by parsePatch, formatPatch, and reversePatch.

  Patches output by git diff can include some features that are unlike those output by GNU diff, and therefore not handled by an ordinary unified diff format parser. An ordinary diff simply describes the differences between the content of two files, but Git diffs can also indicate, via "extended headers", the creation or deletion of (potentially empty) files, indicate that a file was renamed, and contain information about file mode changes. Furthermore, when these changes appear in a diff in the absence of a content change (e.g. when an empty file is created, or a file is renamed without content changes), the patch will contain no associated ---/+++ file headers nor any hunks.

  jsdiff previously did not support parsing Git's extended headers, nor hunkless patches. Now parsePatch parses some of the extended headers, parses hunkless Git patches, and can determine filenames (e.g. from the extended headers) when parsing a patch that includes no --- or +++ file headers. The additional information conveyed by the extended headers we support is recorded on new fields on the result object returned by parsePatch. See isGit and subsequent properties in the docs in the README.md file.

  formatPatch now outputs extended headers based on these new Git-specific properties, and reversePatch respects them as far as possible (with one unavoidable caveat noted in the README.md file).

• Unpaired file headers now cause parsePatch to throw.

  It remains acceptable to have a patch with no file headers whatsoever (e.g. one that begins with a @@ hunk header on the very first line), but a patch with only a --- header or only a +++ header is now considered an error.

• parsePatch is now more tolerant of "trailing garbage"

  That is: after a patch, or between files/indexes in a patch, it is now acceptable to have arbitrary lines of "garbage" (so long as they unambiguously have no syntactic meaning - e.g. trailing garbage that leads with a +, -, or and thus is interpretable as part of a hunk still triggers a throw).

  This means we no longer reject patches output by tools that include extra data in "garbage" lines not understood by generic unified diff parsers. (For example, SVN patches can include "Property changes on:" lines that generic unified diff parsers should discard as garbage; jsdiff previously threw errors when encountering them.)

  This change brings jsdiff's behaviour more in line with GNU patch, which is highly permissive of "garbage".

• The oldFileName and newFileName fields of StructuredPatch are now typed as string | undefined instead of string. This type change reflects the (pre-existing) reality that parsePatch can produce patches without filenames (e.g. when parsing a patch that simply contains hunks with no file headers).

Commits

• ed13aca Update version in package.json and in release notes (#683)
• 7a49317 Bump dependencies again (#682)
• afe5aec Add Git support, and otherwise variously improve & fix parsePatch (and other ...
• 2e46779 Fix a typo (#679)
• See full diff in compare view

Updates entities from 7.0.1 to 9.0.0

Release notes

Sourced from entities's releases.

v9.0.0

Full speed unlocked: This release features a faster approach to decoding entities based on cuckoo hashing, replacing the previous trie-based approach. Instead of walking a trie character by character, we now do a few lookups in a hash table.

I first looked into cuckoo hashing around 2015, and again when I adopted the trie approach that @​inikulin had pioneered for parse5, but could never make it work. This was a fun problem to throw AI models at for some time, but now Fable solved it quite well.

This feels like the last big speed boost for entities decoding in JS.

Breaking changes

• Streaming decoders no longer take a decode table: new EntityDecoder(htmlDecodeTree, emit, errors) becomes new HtmlEntityDecoder(emit, errors), and XmlEntityDecoder replaces the XML variant. The htmlDecodeTree, xmlDecodeTree and determineBranch exports are removed. Synchronous decoding APIs are unchanged. #2336
• Encoding emits decimal numeric references and the shortest named aliases: encodeXML("ü") yields &[#252](https://github.com/fb55/entities/issues/252); instead of ü, and encodeHTML("ℵ") yields ℵ instead of ℵ. #2355
• escapeAttribute and EncodingMode.Attribute also escape < and >, matching the latest HTML spec. By @​ybai08 in #2398
• The deprecated getCodePoint export of entities/escape is removed; use String.prototype.codePointAt instead. #2355

Improvements

• HTML decoding: common named references 1.15–1.23×, a dense sweep of all 2,125 names 1.24–1.33×, attribute-heavy HTML 1.06–1.18× as fast. XML decoding with mixed named and numeric references is 1.06–1.09× as fast. #2336
• Smaller decoders: the HTML bundle shrinks from 15.54 to 13.42 kB gzipped, the XML-only bundle from 0.92 to 0.84 kB gzipped, and 29–32 kB less memory is retained after import. #2336
• The readme now compares entities with popular alternatives across a range of inputs. #2407

Compared with v8.1.0; ranges span Node 26.8 and Node 24.19 on a Ryzen 7 5800X3D. Results vary with input.

Full Changelog: fb55/entities@v8.1.0...v9.0.0

v8.1.0

Faster decoding & escaping, with smaller bundles. Encoding output stays compatible with v8.

Improvements

• Decoding: decodeHTML 1.19×, decodeHTMLStrict 1.14×, decodeHTMLAttribute 1.18×, decodeXML 1.46×, default decode 1.44× as fast. #2248, #2348
• Escaping: escapeUTF8 1.49×, escapeAttribute 1.23×, escapeText 1.33× as fast. #2247, #2348
• Encoding mostly ASCII 4 KiB prose: encodeHTML 1.70×, encodeNonAsciiHTML 2.24×, encodeXML / escape 2.46× as fast. On the short, dense benchmark input, HTML encoding is unchanged; XML encoding and default encode take about 6% longer. #2246, #2348
• 19% smaller full bundle (18% gzipped), targeting ES2022.

Compared with v8.0.0; speedups are medians of nine runs on Node 26.8.1, Linux/x64. Short inputs use the repository benchmark fixtures; results vary with input.

Fixes

• decodeHTMLAttribute preserves interrupted references such as &notin<, previously incorrectly decoded to ¬in<. #2213
• decodeHTML preserves unterminated names such as &Xi$, previously incorrectly decoded to Â. #2331
• decodeXML and default decode preserve XML numeric code points: € now yields U+0080 instead of €. HTML decoding still yields €. By @​adarshx01 in #2347.

Deprecations

• Use String.prototype.codePointAt instead of getCodePoint from entities/escape. #2268

Full Changelog: fb55/entities@v8.0.0...v8.1.0

v8.0.0

What's Changed

... (truncated)

Commits

• a007e72 9.0.0
• 3e8e364 build(benchmark): compare popular libraries across inputs, update readme (#2407)
• d1158bf feat(decode)!: hash-table decoder replacing the binary trie (#2336)
• 914e397 fix(escape): escape \< and > in attribute values (#2398)
• 12d4f06 build: bump the codeql group with 2 updates (#2405)
• 0a6de5c build: bump markdown-it from 14.3.2 to 14.3.3 (#2402)
• 9659d80 build: bump the codeql group with 2 updates (#2401)
• 858a16b build: bump vitest from 5.0.4 to 5.0.5 (#2400)
• 52cbad3 build: bump eslint from 10.12.0 to 10.13.0 (#2399)
• ff0bad1 build: bump typescript-eslint from 8.71.1 to 8.71.2 (#2396)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for entities since your current version.

Updates highlight.js from 11.11.1 to 11.12.0

Release notes

Sourced from highlight.js's releases.

v11.12.0 - Summer, hot and rainy.

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]
• enh(kotlin) add ktm and ktx aliases [DarkMatter-999][]
• fix(leaf) fix bug in Leaf keyword highlighting [Francesco Paolo Severino][]
• fix(lisp) preserve highlighting after quoted multiplication expressions [arturict][]

... (truncated)

Changelog

Sourced from highlight.js's changelog.

Version 11.12.0

Parser Engine:

• fix(parser) count named capture groups when rewriting backreferences [spokodev][]

New Grammars:

• add FreeDesktop config file (.desktop / systemd) grammar [gg582][]
• added 3rd party Cedar grammar to SUPPORTED_LANGUAGES [Dhruv Maniya][]
• added 3rd party DAX and M (Power Query) grammars to SUPPORTED_LANGUAGES [jiaopengzi][]
• added 3rd party Djot grammar to SUPPORTED_LANGUAGES [Mark Scherer][]
• added 3rd party Igor Pro grammar to SUPPORTED_LANGUAGES [Ryne Andal][]
• added 3rd party Jaiva grammar to SUPPORTED_LANGUAGES [Lehlogonolo Poole][]
• added 3rd party Liquidsoap grammar to SUPPORTED_LANGUAGES [Romain Beauxis][]
• added 3rd party MoonBit grammar to SUPPORTED_LANGUAGES [Kaida-Amethyst][]
• added 3rd party Pkl grammar to SUPPORTED_LANGUAGES [Dan Chao][]
• added 3rd party RAScript grammar to SUPPORTED_LANGUAGES [Joshua Raphael][]
• added 3rd party Veryl grammar to SUPPORTED_LANGUAGES [Naoya Hatta][]
• added 3rd party Why3 grammar to SUPPORTED_LANGUAGES [JGalego][]
• added 3rd party Xojo grammar to SUPPORTED_LANGUAGES [patricksalo][]
• referenced existing 3rd party ES|QL grammar in SUPPORTED_LANGUAGES [Styx0x6][]

Core Grammars:

• fix(c) only match real atomic_* type names, not C11 atomic functions, issue #3837 [Mark Xian][]
• fix(c) do not highlight C++ std types as built-ins, issue #4103 [Arron Zou][]
• fix(c, cpp) bound the run of type tokens in front of a function name (ReDoS), issue #4362 [Jayesh Bhade][]
• fix(c, cpp) scope angle-bracket header string to #include, issue #3505 [Pablo][]
• fix(c, cpp) stop a raw string's closing delimiter from swallowing quotes, issue #3585 [David Pavlovschii][]
• enh(cmake) add block and endblock keywords [Anonymous Maarten][]
• fix(cmake) only highlight standalone numbers, not digits that begin an identifier (e.g. 3rdparty), issue #4170 [Mark Xian][]
• fix(cpp) require a word boundary before numeric literals so digits inside identifiers aren't highlighted as numbers, issue #4231 [Mark Xian][]
• fix(crystal) stop treating integer division // as a regex literal [Zain Asif][]
• enh(csharp) support digit separators in binary literals and numeric type suffixes, and stop highlighting the leading _ of an identifier, issue #4258 [Sarath Francis][]
• enh(css) add corner-shape properties [Hama Tanveer][]
• enh(css) support six-digit unicode-range values [Konstantin Baltsat][]
• enh(dart) add highlighting for class and function names [guuido][]
• enh(dns) highlight registered CAA property tags, issue #4475 [Joey Huang][]
• enh(dns) improve grammar: character strings, TXT, classes, escapes, addresses [Checconio][]
• enh(dos) add batch as an alias, issue #4395 [Hashim Khan][]
• enh(gherkin) update keyword list [Hirse][]
• enh(gherkin) variables can't contain whitespace [Hirse][]
• enh(gherkin) docstrings can use backticks [Hirse][]
• enh(go) recognize binary integer literals [spokodev][]
• enh(groovy) support underscores in numeric literals [greymoth][]
• fix(haml) recognize implicit div tag lines starting with .class or #id, issue #3783 [pikammmmm][]
• fix(haskell) highlight where in GADT and closed type-family declarations, issue #3753 [Konstantin Baltsat][]
• enh(java) improve detection of types, including generic and array types [Hannes Wallnoefer][]
• enh(javascript) add self to built-in variables [Dsaquel][]

... (truncated)

Commits

• f7f7d38 (release) release v11.12.0
• c4c4728 (docs) FreeDesktop + Kotlin aliases; note extra language override
• 9142292 bump version to 11.12.0
• 03d1e7e (chore) rebuild CHANGES.md for 11.12.0
• ca6bb8e enh(sqf) update to A3 v2.22 (#4460)
• 1414c96 fix: use Trusted Publishers in publishing pipeline (#4427)
• 2a9ad7d fix(markdown) don't treat a thematic break as the start of bold text (#4485)
• 375f3f4 build(deps-dev): bump @​rollup/plugin-commonjs from 28.0.1 to 29.0.3 (#4481)
• 2ce1706 build(deps-dev): bump del from 8.0.0 to 8.0.1 (#4484)
• 72084b5 fix(ruby): don't treat scope resolution :: as symbols (#4463)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for highlight.js since your current version.

Updates katex from 0.19.0 to 0.19.1

Release notes

Sourced from katex's releases.

v0.19.1

0.19.1 (2026-10-23)

Bug Fixes

• allow percent sign in raw argument type (#4307) (6971e5c)

Changelog

Sourced from katex's changelog.

0.19.1 (2026-10-23)

Bug Fixes

• allow percent sign in raw argument type (#4307) (6971e5c)

Commits

• 8000fbd chore(release): 0.19.1 [ci skip]
• 6971e5c fix: allow percent sign in raw argument type (#4307)
• 8f0d9bc chore: handle devicePixelRatio in screenshotter (#4303)
• faa8a4c docs(users): add Whiteboard (#4310)
• f18d73d docs(users): add Liubai (#4313)
• 4ffde03 chore(deps): bump github/codeql-action from 4.38.3 to 4.39.0 (#4314)
• cac2561 chore(deps): bump github/codeql-action from 4.38.2 to 4.38.3 (#4306)
• See full diff in compare view

Updates marked from 18.0.3 to 18.1.2

Release notes

Sourced from marked's releases.

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

• allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)
• apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)
• cli: await config functions before parsing (#4138) (3a11ad1)
• cli: create no-clobber output files atomically (#4135) (e7c4f64)
• do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)
• expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)
• honor per-call async options when composing hooks (#4139) (379be9d)
• keep a line starting with # but no space in the list item (#4127) (6b63189)
• keep duplicate link definitions in the tokens (#4132) (2784acc)
• keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)
• keep lazy setext underlines in list items as text (#4126) (398234c)
• render nested image alt formatting as plain text (#4131) (15f59bb)
• stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

• ~16% faster parsing by skipping em/strong masking for runs without *, _ or ~ (#4142) (f0fd3e0)

v18.1.1

18.1.1 (2026-10-12)

Bug Fixes

• cli: honor an explicitly empty string input (#4113) (ec3a4e5)
• end blockquote before a lazy line after a heading, hr or html block (#4115) (9e64a6a)
• keep a backslash in a code span from hiding emphasis (#4117) (6a57018)
• keep a decoded character reference from forming a new one (#4111) (6bbac0c), closes #38 #112
• let indented and type 3-5 html blocks interrupt a paragraph (#4124) (eaa1fff)
• make walkTokens linear by appending values in place (#4121) (627d9ae), closes #4120
• match pre, script, style and textarea as whole tag names (#4114) (0db74cb)
• preserve enclosing link state after parsing images (#4123) (cc07bb9)
• respect tab stops in list continuation indentation (#4119) (4bd2528)

Performance Improvements

• avoid repeated raw string copies in nested lists (#4082) (7e8754d)

v18.1.0

18.1.0 (2026-10-05)

... (truncated)

Commits

• 5beecae chore(release): 18.1.2 [skip ci]
• c1e6ca1 chore(deps): update deps (#4168)
• 3a01ac4 chore: test:redos -> test:recheck (#4167)
• 15f59bb fix: render nested image alt formatting as plain text (#4131)
• 2d3899b fix: expand a tab after the block quote marker to the next tab stop (#4110)
• e09c40d fix: allow a tab or end of input after a type 6 html block tag name (#4128)
• 398234c fix: keep lazy setext underlines in list items as text (#4126)
• 6b63189 fix: keep a line starting with # but no space in the list item (#4127)
• 5d8e234 fix: apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145)
• 3a11ad1 fix(cli): await config functions before parsing (#4138)
• Additional commits viewable in compare view

Updates mermaid from 11.16.1 to 12.2.0

Release notes

Sourced from mermaid's releases.

mermaid@12.2.0

Minor Changes

• #8394 6ac38cb Thanks @​jackroberts236! - feat: Add opt-in mindmap coloring by hierarchy depth using mindmap.colorBy: depth and the existing theme palette.

Patch Changes

• #8409 419ee68 Thanks @​ashishjain0512! - fix: size circle and double-circle nodes from their label instead of minNodeWidth, and trim neo circle padding

• #8395 2fb3ff1 Thanks @​ashishjain0512! - fix: ELK no longer straightens an edge terminal when that would put a label over another edge, or an edge through a label

• #8394 cbf89ab Thanks @​jackroberts236! - fix: Keep mindmap HTML labels readable in the neo look on themes that repaint node backgrounds

• #8390 430ac9b Thanks @​ashishjain0512! - fix: Centre mindmap node labels when htmlLabels is false

• #8161 d7532ed Thanks @​filipsajdak! - fix: scope a swimlane cluster's DOM id like every other cluster, so two diagrams on one page do not collide

• #8270 ad8d61a Thanks @​filipsajdak! - fix(rendering): clip an edge for the layout engine that drew it, so a diagram pinning its own engine (bpmn, swimlanes) still renders when the configured default is another one

• #8383 9d41c0f Thanks @​filipsajdak! - fix(swimlanes): split shared terminal lanes again after crossing cleanup, so an edge that detours around another lane no longer ends on the same attachment point as a neighbouring edge

• #8384 6c67397 Thanks @​filipsajdak! - fix(swimlanes): move a lane's title band clear of an edge that crosses it, in LR diagrams whose lanes carry no direction of their own and when the edge runs along the band's border

• #8366 40124c3 Thanks @​SwastikTripathi! - fix: swimlane nodes with no edges keep their source order inside a lane instead of being sorted by ID

mermaid@12.1.0

Minor Changes

• #8303 9140716 Thanks @​filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

• #8250 fd4f5f2 Thanks @​kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current behaviour, and descending mirrors every row so it reads from that row's highest bit down to its lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram between the two conventions only means changing bitOrder.

Patch Changes

• #8330 50c9e55 Thanks @​ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

• #8259 4c90f5c Thanks @​afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

  participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error, even though the plain form without a config object tolerates trailing whitespace just fine.

• #8339 c7fa1a5 Thanks @​ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

• #8334 d67331d Thanks @​ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

• #8344 99a050b Thanks @​pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

... (truncated)

Commits

• 1fb7869 Merge pull request #8432 from mermaid-js/changeset-release/master
• 34772ca Version Packages
• 42292ea Merge pull request #8428 from mermaid-js/release/12.2.0
• e6c8059 Wrong version set previously
• Description has been truncated