[posit-snyk-bot]

Snyk has created this PR to fix 1 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

• package.json
• yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory.
If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

	Issue	Score
	Cross-site Scripting (XSS) SNYK-JS-DOMPURIFY-21460657	188

Breaking Change Risk

Notice: This assessment is enhanced by AI.

---

Important

• Check the changes in this PR to ensure they won't cause issues with your project.
• Max score is 1000. Note that the real score may have changed since the PR was raised.
• This PR was automatically created by Snyk using the credentials of a real user.

---

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

---

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)

[posit-snyk-bot]

This is a major version upgrade from v9 to v10 which introduces significant breaking changes that require code modifications.

Key Breaking Changes:

• ESM Only Package: As of v10, Mermaid is an ESM-only package. This means you can no longer use require('mermaid'). You must switch to using import statements. This change may require build tool or package.json configuration updates (e.g., adding "type": "module").
• Asynchronous Rendering: The mermaid.render() function is now asynchronous and returns a Promise. Calls to this function must be updated to use await or .then() to handle the returned promise. Failure to do so will lead to inconsistent or failed diagram rendering.
• init() Deprecation: The mermaid.init() function is deprecated and has been replaced by the new mermaid.run() function. mermaid.run() is also asynchronous and is the preferred method for rendering diagrams in v10.

Recommendation:

Developers must review all integrations with the Mermaid library and refactor the code to use ESM imports and handle the asynchronous nature of the rendering functions. Update calls from the deprecated mermaid.init() to the new mermaid.run() method.

Source: Mermaid v10 Usage Docs, GitHub Issues

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.