Skip to content

chore: upgrade Mermaid to the latest stable version - #5681

Merged
asyncapi-bot merged 8 commits into
asyncapi:masterfrom
princerajpoot20:fix-vulnerabilities
Aug 3, 2026
Merged

chore: upgrade Mermaid to the latest stable version#5681
asyncapi-bot merged 8 commits into
asyncapi:masterfrom
princerajpoot20:fix-vulnerabilities

Conversation

@princerajpoot20

@princerajpoot20 princerajpoot20 commented Aug 2, 2026

Copy link
Copy Markdown
Member

Related #5633

Summary by CodeRabbit

  • New Features

    • Added Mermaid diagram rendering with light and dark theme support.
    • Added clear handling for empty or invalid diagram definitions.
    • Added a loading state while diagrams are prepared.
  • Bug Fixes

    • Improved reliability when pages update or components are removed.
    • Sanitized rendered diagram output to strengthen security.
  • Refactor

    • Mermaid rendering now loads dynamically for improved performance and stability.

@netlify

netlify Bot commented Aug 2, 2026

Copy link
Copy Markdown

Deploy Preview for asyncapi-website ready!

Built without sensitive environment variables

Name Link
🔨 Latest commit b908eed
🔍 Latest deploy log https://app.netlify.com/projects/asyncapi-website/deploys/6a6f74667840e60008ef6ce9
😎 Deploy Preview https://deploy-preview-5681--asyncapi-website.netlify.app
📱 Preview on mobile
Toggle QR Code...

QR Code

Use your smartphone camera to open QR code link.
🤖 Make changes Run an agent on this branch

To edit notification comments on pull requests, go to your Netlify project configuration.

@coderabbitai

coderabbitai Bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
📝 Walkthrough

Walkthrough

Mermaid rendering moved from MDX.tsx into a client-only MermaidDiagram component. The component loads Mermaid 11, responds to theme changes, sanitizes SVG output, and handles empty or failed renders. Edge-function tests now use scoped fetch stubs.

Changes

Mermaid rendering

Layer / File(s) Summary
Mermaid runtime setup
package.json, next.config.mjs
The project upgrades mermaid to 11.16.0, adds dompurify at 3.4.12, and externalizes langium and @mermaid-js/parser on the server.
Theme-aware diagram component
components/MDX/MermaidDiagram.tsx
MermaidDiagram loads Mermaid dynamically, tracks theme changes, renders trimmed graph definitions, sanitizes SVG output, handles empty or failed renders, and prevents updates after unmount.
Client-only MDX integration
components/MDX/MDX.tsx
MDX dynamically imports MermaidDiagram with server-side rendering disabled and adds a loading placeholder.

Fetch test stub migration

Layer / File(s) Summary
Scoped fetch test setup
netlify/edge-functions/tests/serve-definitions.test.ts
Tests replace mock_fetch with disposable stub instances and retain request, response-status, and content-type assertions.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant MDX
  participant MermaidDiagram
  participant Mermaid
  participant DOMPurify
  MDX->>MermaidDiagram: pass graph definition
  MermaidDiagram->>Mermaid: load and render graph
  Mermaid-->>MermaidDiagram: return SVG
  MermaidDiagram->>DOMPurify: sanitize SVG
  DOMPurify-->>MermaidDiagram: return sanitized SVG
  MermaidDiagram-->>MDX: render SVG or error
Loading

Possibly related PRs

Suggested reviewers: akshatnema, anshgoyalevil, asyncapi-bot-eve

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 66.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly identifies the primary change: upgrading Mermaid from version 9.3.0 to version 11.16.0.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@princerajpoot20 princerajpoot20 changed the title security: upgrade Mermaid to the latest stable version chore: upgrade Mermaid to the latest stable version Aug 2, 2026
@asyncapi-bot

asyncapi-bot commented Aug 2, 2026

Copy link
Copy Markdown
Contributor

⚡️ Lighthouse report for the changes in this PR:

Category Score
🟠 Performance 50
🟢 Accessibility 98
🟢 Best practices 92
🟢 SEO 100
🔴 PWA 33

Lighthouse ran on https://deploy-preview-5681--asyncapi-website.netlify.app/

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

🧹 Nitpick comments (1)
components/MDX/MDX.tsx (1)

44-44: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider a loading fallback for the dynamic import.

Without a loading option, next/dynamic renders nothing until the MermaidDiagram chunk loads, which can cause a layout shift for pages containing diagrams.

💡 Optional improvement
-const MermaidDiagram = dynamic(() => import('./MermaidDiagram'), { ssr: false });
+const MermaidDiagram = dynamic(() => import('./MermaidDiagram'), {
+  ssr: false,
+  loading: () => <div className="animate-pulse h-40 w-full rounded bg-gray-200 dark:bg-gray-700" />
+});
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/MDX/MDX.tsx` at line 44, Update the MermaidDiagram dynamic import
configuration to include a loading fallback via next/dynamic’s loading option.
Use a suitable placeholder that preserves diagram space while the chunk loads,
while keeping server-side rendering disabled.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@components/MDX/MermaidDiagram.tsx`:
- Around line 70-85: Initialize the theme state lazily in MermaidDiagram using
getMermaidTheme instead of hard-coding 'light', so the first render effect runs
with the site's actual theme and avoids an unnecessary corrective render. Keep
the existing MutationObserver update and cleanup behavior unchanged.
- Around line 127-129: Update the effect callback in MermaidDiagram so every
exit path has a consistent return shape: the early exit should explicitly return
the same no-cleanup value used by React effects, while the mounted cleanup path
continues returning its cleanup function. Preserve the existing mounted
assignment and cleanup behavior.
- Around line 96-132: Sanitize the SVG returned by mermaid.render before storing
it in state: in the render function, import DOMPurify from mermaid and pass
rendered through DOMPurify.sanitize with the SVG profile, then call setSvg with
the sanitized result. Keep the existing mounted check and error handling
unchanged.

---

Nitpick comments:
In `@components/MDX/MDX.tsx`:
- Line 44: Update the MermaidDiagram dynamic import configuration to include a
loading fallback via next/dynamic’s loading option. Use a suitable placeholder
that preserves diagram space while the chunk loads, while keeping server-side
rendering disabled.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c7361161-f1bd-4805-937f-ee392e887e8b

📥 Commits

Reviewing files that changed from the base of the PR and between 1a4120e and 3a0e804.

⛔ Files ignored due to path filters (1)
  • package-lock.json is excluded by !**/package-lock.json
📒 Files selected for processing (4)
  • components/MDX/MDX.tsx
  • components/MDX/MermaidDiagram.tsx
  • next.config.mjs
  • package.json

Comment thread components/MDX/MermaidDiagram.tsx Outdated
Comment thread components/MDX/MermaidDiagram.tsx Outdated
Comment thread components/MDX/MermaidDiagram.tsx

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
components/MDX/MermaidDiagram.tsx (1)

109-116: 🩺 Stability & Availability | 🔵 Trivial | ⚡ Quick win

Consider surfacing a fallback message when rendering fails.

On a render error, setSvg(null) clears the SVG and the error is only logged to the console (line 115). The user sees a blank <div> with no indication that the diagram failed to render. Consider tracking an error state and rendering a short fallback message so readers of the page know the diagram is unavailable rather than assuming a rendering delay.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@components/MDX/MermaidDiagram.tsx` around lines 109 - 116, The MermaidDiagram
error path currently leaves a blank container after rendering fails. Add an
error state in MermaidDiagram, set it in the catch block alongside clearing the
SVG, and render a concise fallback message when that state is active so users
know the diagram is unavailable.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@components/MDX/MermaidDiagram.tsx`:
- Around line 87-120: Update the graph branching in the MermaidDiagram render
flow to check the positive graph condition first, moving the existing
asynchronous render logic into that branch and retaining setSvg(null) for the
absent-graph path. Preserve the current rendering, error handling, and mounted
checks.

---

Nitpick comments:
In `@components/MDX/MermaidDiagram.tsx`:
- Around line 109-116: The MermaidDiagram error path currently leaves a blank
container after rendering fails. Add an error state in MermaidDiagram, set it in
the catch block alongside clearing the SVG, and render a concise fallback
message when that state is active so users know the diagram is unavailable.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 3ca57637-564f-4e61-b7d0-3ac858590afe

📥 Commits

Reviewing files that changed from the base of the PR and between 3a0e804 and dcaec53.

📒 Files selected for processing (2)
  • components/MDX/MDX.tsx
  • components/MDX/MermaidDiagram.tsx
🚧 Files skipped from review as they are similar to previous changes (1)
  • components/MDX/MDX.tsx

Comment thread components/MDX/MermaidDiagram.tsx Outdated

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
package.json (1)

75-75: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Pin the dependency versions selected for this PR.

^3.4.0 and ^11.4.1 allow later minor releases when dependencies are resolved again. Mermaid output and parser behavior can then change without a source diff. Pin the resolved dompurify and mermaid versions, and keep the lockfile aligned.

Verify that CI uses the committed lockfile with a frozen install before retaining these ranges.

Based on learnings, this repository prefers exact versions or conservative ranges for reproducible builds.

Also applies to: 89-89

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 75, Update the package.json entries for dompurify and
mermaid to use the resolved exact versions instead of caret ranges, then
regenerate or adjust the lockfile so it matches those versions. Verify CI
performs a frozen install using the committed lockfile before finalizing the
dependency changes.

Source: Learnings

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@components/MDX/MermaidDiagram.tsx`:
- Around line 89-90: Update the graph handling in MermaidDiagram to compute and
reuse a trimmed graph value before deciding whether to render, so
whitespace-only content follows the empty fallback instead of being passed to
Mermaid. In the empty-state cleanup around the svg reset, also reset hasError to
prevent a prior render failure from persisting; add regression coverage for
whitespace-only input and the failed-render-to-empty transition.

---

Nitpick comments:
In `@package.json`:
- Line 75: Update the package.json entries for dompurify and mermaid to use the
resolved exact versions instead of caret ranges, then regenerate or adjust the
lockfile so it matches those versions. Verify CI performs a frozen install using
the committed lockfile before finalizing the dependency changes.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 27392067-cb29-4a4e-9592-0559afcd070c

📥 Commits

Reviewing files that changed from the base of the PR and between dcaec53 and 471dec4.

📒 Files selected for processing (2)
  • components/MDX/MermaidDiagram.tsx
  • package.json

Comment thread components/MDX/MermaidDiagram.tsx Outdated
@princerajpoot20

princerajpoot20 commented Aug 2, 2026

Copy link
Copy Markdown
Member Author

netlify/edge-functions/tests/serve-definitions.test.ts is failing. It doesn't seem to be due to the changes in this PR. checking..

Reference Run: https://github.com/asyncapi/website/actions/runs/30749023695/job/91500185845?pr=5681
Screenshot 2026-08-02 at 8 14 28 PM

@princerajpoot20

Copy link
Copy Markdown
Member Author

deno.land/x/mock_fetch@0.3.0 imports https://crux.land/router@0.0.5 on line 1 of its source. crux.land is a Deno CDN that went offline in 2023. It seems this was continuing to work because of Deno's module cache.

I verified this with a recent pipeline from another PR as well. Reference: https://github.com/asyncapi/website/actions/runs/30748413716/job/91508982939?pr=5592. That pipeline is now failing too.

The reason the cache stopped working now is that the CI environment invalidated the Deno module cache. This could be due to recent changes we made in the CI configuration or simply periodic cache cleanup. Either way, the cache is now gone, so the build is failing because it can no longer fetch the module from crux.land.

Working on a fix.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
netlify/edge-functions/tests/serve-definitions.test.ts (1)

3-3: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Add a reproducible lock for the JSR testing import.

netlify/edge-functions/tests/serve-definitions.test.ts imports unversioned jsr:@std/testing/mock``, and this repository does not provide deno.lock, `deno.json`, or `deno.jsonc`. Pin `@std/testing` in a `deno.lock`/Deno config or use a fully versioned remote specifier.

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@netlify/edge-functions/tests/serve-definitions.test.ts` at line 3, Pin the
`@std/testing` dependency used by the stub import in serve-definitions.test.ts so
it resolves reproducibly. Add the dependency version through the repository’s
Deno lock/config mechanism, or replace the unversioned jsr:`@std/testing/mock`
specifier with a fully versioned one; do not leave the import unpinned.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@netlify/edge-functions/tests/serve-definitions.test.ts`:
- Line 3: Pin the `@std/testing` dependency used by the stub import in
serve-definitions.test.ts so it resolves reproducibly. Add the dependency
version through the repository’s Deno lock/config mechanism, or replace the
unversioned jsr:`@std/testing/mock` specifier with a fully versioned one; do not
leave the import unpinned.

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 47d4d130-c7ad-4899-bcfa-05520790f622

📥 Commits

Reviewing files that changed from the base of the PR and between 2647a38 and 4f6680e.

📒 Files selected for processing (1)
  • netlify/edge-functions/tests/serve-definitions.test.ts

@sonarqubecloud

sonarqubecloud Bot commented Aug 2, 2026

Copy link
Copy Markdown

@anshgoyalevil

Copy link
Copy Markdown
Member

/rtm

@asyncapi-bot
asyncapi-bot merged commit 3b98516 into asyncapi:master Aug 3, 2026
20 checks passed
@github-project-automation github-project-automation Bot moved this from To Be Triaged to Done in Website - Kanban Aug 3, 2026
@princerajpoot20
princerajpoot20 deleted the fix-vulnerabilities branch August 5, 2026 17:08
@github-actions github-actions Bot added the microgrant Participation in the Microgrant Program label Aug 21, 2026
@aeworxet aeworxet removed the status in Microgrant Program Aug 21, 2026
@aeworxet aeworxet moved this to Completed in Microgrant Program Aug 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

microgrant Participation in the Microgrant Program ready-to-merge

Projects

Status: Completed
Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants