chore(deps): bump mermaid to 11.16.1 and js-yaml to 4.3.1 to clear open Dependabot alerts

[waleedlatif1]

Summary

• Bump mermaid 11.15.0 → 11.16.1, clearing five open Dependabot alerts: architecture-diagram and config-API prototype pollution, radar and XY-chart DoS, and CSS injection into siblings of the diagram
• Bump js-yaml 4.3.0 → 4.3.1 for CVE-2026-59870 (quadratic CPU consumption in !!omap resolution), which was never backported to the 4.3.0 line
• Both releases are inside the 7-day minimumReleaseAge supply-chain gate, so each gets a bunfig.toml exception with a dated drop note
• Drop the ten minimumReleaseAgeExcludes entries that have aged past the window (Pi 0.80.10 ×4, next/@next/env/@next/swc-* ×6, @anthropic-ai/sdk, @e2b/code-interpreter, e2b) — verified they all still resolve to the same pinned versions with the exceptions removed

Not covered here

Three transitive js-yaml copies remain on vulnerable versions: 3.14.2 (via gray-matter, needs 3.15.1) and 4.2.0/4.3.0 (via fumadocs, electron-builder, json-schema-to-typescript). Dependabot did not flag these — it only detected the direct manifest entry. A root overrides forcing 4.3.1 would break gray-matter, which needs js-yaml 3's safeLoad, so these want a separate PR with per-package overrides.

Type of Change

• Security fix

Testing

bun run type-check clean. 55 mermaid/YAML tests pass across lib/mermaid, lib/file-parsers/yaml-parser, lib/chunkers/json-yaml-chunker, and file-viewer/mermaid-diagram.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Building	Preview	Aug 7, 2026 5:07pm

[cursor]

PR Summary

Low Risk
Dependency-only security patches with no runtime logic changes; residual transitive js-yaml versions noted in the PR remain out of scope.

Overview
Security dependency bumps with lockfile and supply-chain gate updates—no application code changes.

mermaid is raised from 11.15.0 to 11.16.1 in apps/sim/package.json, root overrides, and bun.lock, addressing several open Dependabot issues (prototype pollution, chart DoS, diagram-adjacent CSS injection). js-yaml moves from 4.3.0 to 4.3.1 for CVE-2026-59870 (!!omap quadratic CPU).

Because both releases are still inside the repo’s 7-day minimumReleaseAge window, bunfig.toml adds dated minimumReleaseAgeExcludes for mermaid and js-yaml and removes ten exclusions that have aged out (Pi packages, Next/SWC pins, Anthropic SDK, E2B)—those packages still resolve to the same pinned versions without exceptions.

^{Reviewed by Cursor Bugbot for commit fddd10a. Configure here.}

[greptile-apps]

Greptile Summary

This PR upgrades the direct Mermaid and js-yaml dependencies to patched releases and updates the lockfile consistently. It also refreshes Bun’s minimum-release-age exceptions by adding temporary exceptions for the new releases and removing expired entries.

• Upgrades Mermaid from 11.15.0 to 11.16.1 across the application manifest, root override, and lockfile.
• Upgrades the direct js-yaml dependency from 4.3.0 to 4.3.1.
• Updates Mermaid parser and related transitive package resolutions.
• Replaces expired Bun release-age exceptions with exceptions for Mermaid and js-yaml.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified in the dependency or release-age configuration changes.

The patched dependencies resolve coherently, existing application usage remains compatible, and the release-age exception updates do not create a reachable install, build, or runtime failure.

Important Files Changed

Filename	Overview
apps/sim/package.json	Updates the application’s direct Mermaid and js-yaml pins; repository callers remain compatible with the patched releases.
bun.lock	Regenerates direct and transitive resolutions coherently, including Mermaid’s parser update and js-yaml’s direct patched resolution.
bunfig.toml	Removes expired release-age exclusions and temporarily exempts the newly pinned security releases.
package.json	Keeps the root Mermaid override aligned with the application dependency and lockfile.

_{Reviews (1): Last reviewed commit: "chore(deps): bump mermaid to 11.16.1 and..." | Re-trigger Greptile}