fix(security): bump mermaid 11.14.0 -> 11.15.0 (CSS+HTML injection CVEs)

[aaronjmars]

Summary

Bumps mermaid from 11.14.0 to 11.15.0 to close four published advisories, all detected by osv-scanner against the current pnpm-lock.yaml.

GHSA	Title	Severity
GHSA-87f9-hvmw-gh4p	Improper sanitization of configuration leads to CSS injection	Medium
GHSA-ghcm-xqfw-q4vr	Improper sanitization of classDef in state diagrams leads to HTML injection	Medium
GHSA-xcj9-5m2h-648r	Improper sanitization of classDefs in diagrams leads to CSS injection	Medium
GHSA-6m6c-36f7-fhxh	Gantt charts vulnerable to infinite-loop DoS	Low

All four are fixed in mermaid 11.15.0.

Impact

mermaid is a runtime dependency rendered through src/components/MermaidDiagram.tsx. A note that lands in the user's vault — copied between vaults, synced via git, shared in a starter pack, dropped in by an MCP create_note call — can include a Mermaid fence whose source the user does not control. The advisories cover bypasses against mermaid's classDef/configuration sanitisation that survive securityLevel: 'strict' and htmlLabels: false in the affected range, so the existing initialisation in MermaidDiagram.tsx is not enough on its own.

Tolaria's production CSP (src-tauri/tauri.conf.json) drops 'unsafe-inline' and 'unsafe-eval' on script-src, which already narrows the script-execution path. The remaining injection surface is HTML- and CSS-based (style exfiltration / UI redress), plus the Gantt DoS — the dependency bump is the cleanest backstop instead of relying on CSP and renderer-side mitigation.

Location

• package.json:70 — mermaid floor.
• pnpm-lock.yaml — version + transitives.

Fix

Bump mermaid from ^11.14.0 to ^11.15.0 and refresh the pnpm lockfile. No source changes; MermaidDiagram.tsx keeps securityLevel: 'strict' and htmlLabels: false.

Notable lockfile churn (net 91 lines removed): mermaid 11.15.0 swaps its old chevrotain-based parser for a smaller @mermaid-js/parser@1.1.1 + es-toolkit chain, so seven chevrotain* and langium entries fall out of the dependency graph in addition to the mermaid version bump itself.

Detected by

Aeon + osv-scanner (v2.3.8).

• Source: pnpm-lock.yaml
• Fixed-by check: re-ran osv-scanner scan source -L pnpm-lock.yaml after the bump — mermaid no longer appears in the results.

Verification

pnpm install --lockfile-only --ignore-scripts   # locks 11.15.0 + transitives
osv-scanner scan source -L pnpm-lock.yaml       # mermaid entries gone

Full project test suite (pnpm test, pnpm test:e2e, cargo test) was not run here — please confirm the bump passes the local check suite before merging.

---

Filed by Aeon.