Skip to content

[DEPENDABOT] Weekly npm updates(deps): Bump mermaid, tinacms and @tinacms/cli - #6

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-f4e16837f7
Open

[DEPENDABOT] Weekly npm updates(deps): Bump mermaid, tinacms and @tinacms/cli#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-f4e16837f7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 6, 2026

Copy link
Copy Markdown

Bumps mermaid to 11.16.1 and updates ancestor dependencies mermaid, tinacms and @tinacms/cli. These dependencies need to be updated together.

Updates mermaid from 9.3.0 to 11.16.1

Release notes

Sourced from mermaid's releases.

mermaid@11.16.1

Patch Changes

  • #8022 12d472c Thanks @​aloisklink! - fix: handle CSS sibling combinators in compileCSS

  • #8022 2cd6dcf Thanks @​aloisklink! - fix: increase protections against prototype pollution

    User-controlled input already has protections against prototype pollution.

    Fixes: GHSA-c4c3-pg64-4m4v

  • #8022 99af3fc Thanks @​aloisklink! - fix(architecture): use Maps and Sets to store groups/services

    Services are now rendered in the order they are defined and more service IDs are now supported.

  • #8022 2cd6dcf Thanks @​aloisklink! - deprecate: Deprecate the mermaidAPI.setConfig() function

    Calling this function has no observable effect, as the next time a render() or parse() is called, the currentConfig is cleared.

  • #8022 630aa7e Thanks @​aloisklink! - fix(xychart): support zero-width x-axis ranges

  • #8022 59b22fa Thanks @​aloisklink! - fix(radar): limit number of ticks to 32

    Setting a ticks value higher than this would only show 32 ticks.

mermaid@11.16.0

Minor Changes

  • #7535 ea1c48f Thanks @​ragelink! - feat(cynefin): Adds the Cynefin framework as a new diagram type (beta) to Mermaid (available as cynefin-beta). The Cynefin framework, created by Dave Snowden, is a decision-making framework that categorizes problems into five complexity domains, widely used in agile, incident management, strategy, and organizational design.

  • #7721 f45cc2c Thanks @​notionparallax! - feat(treeView): add box-drawing character input support for treeView diagrams

  • #7550 f1f4d45 Thanks @​DominicBurkart! - feat(xychart): add per-point text labels for xychart line plots

  • #7527 b4d0442 Thanks @​notionparallax! - feat(treeView): Extends the existing treeView-beta diagram with features useful for representing file/directory structures.

  • #7793 a6f097d Thanks @​SSDWGG! - feat(er): support optional ER attribute types with a ? suffix

  • #7772 37f2e36 Thanks @​devareddy05! - feat(gantt): support multiple excludes / includes lines so long exclusion lists can be split into commented groups (#6270)

  • #7708 4e63e9d Thanks @​txmxthy! - feat(architecture): add align row|column {ids…} directive to architecture-beta diagrams so authors can declare horizontal or vertical alignment of services explicitly.

  • #7760 05223be Thanks @​ngdaniels! - feat(pie): Enhance Pie Chart - Enable donut chart, Set legend position, and highlight slice

  • #7251 216e4e9 Thanks @​ydah! - feat(railroad): Add support for Railroad Diagrams (Syntax Diagrams) with four input syntaxes: IR (railroad-beta), EBNF (railroad-ebnf-beta), ABNF (railroad-abnf-beta), and PEG (railroad-peg-beta).

  • #7774 e5c75e6 Thanks @​ngdaniels! - feat(xychart): enable rotate label on X-axis

... (truncated)

Commits
  • 7ecca0c Version Packages (#8023)
  • 95b1b9c docs: change mermaidAPI.setConfig() changeset (#8024)
  • acc69f1 Merge pull request #8022 from mermaid-js/release/11.16.1
  • eba7287 docs: point changesets to correct commit hashes
  • 12d472c Merge commit from fork
  • 2cd6dcf Merge commit from fork
  • 630aa7e Merge commit from fork
  • 59b22fa Merge commit from fork
  • 99af3fc Merge commit from fork
  • 2337f7e Merge branch 'test/improve-example.html' into release/11.16.1
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mermaid since your current version.


Updates tinacms from 3.4.1 to 3.11.0

Release notes

Sourced from tinacms's releases.

tinacms@3.11.0

Minor Changes

  • #7235 908fe7d Thanks @​joshbermanssw! - Editorial-workflow saves (Save draft / Save to a new branch, and the media create-branch flow) now run a single branch-list lookup instead of two sequential ones, roughly halving the delay before the progress modal appears.

Patch Changes

  • #7194 711ba30 Thanks @​kulesy! - Button now renders the shared loading-dots indicator automatically when busy, so every busy button gets a consistent spinner instead of each call site wiring its own (and some, like the account password form, were missing it entirely). The dots inherit the button text color so they stay visible across variants.

  • #7161 566af78 Thanks @​ahfoysal! - Keep folder collection views open when they only contain one document.

  • #7251 b8df6ee Thanks @​kulesy! - Fix the rich-text link popover not appearing when adding or editing a link.

    Since the popover was moved into a portal on document.body, plate-floating's inline z-index: 50 overrode its z-[999999] class, so it rendered behind the form field wrappers (which use z-index up to 1000) and was invisible. It now sits above them, so clicking the link button shows the URL input as expected.

  • #7204 59efccc Thanks @​joshbermanssw! - Show a clear error when repo-based media is used with a self-hosted site, instead of a misleading "Bad Route" message.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [cdbf469, 056ffc2]:

    • @​tinacms/bridge@​0.3.1
    • @​tinacms/mdx@​2.1.11
    • @​tinacms/search@​1.2.23

tinacms@3.10.1

Patch Changes

  • Updated dependencies [4b4e139]:
    • @​tinacms/mdx@​2.1.10
    • @​tinacms/search@​1.2.22

tinacms@3.10.0

Minor Changes

Patch Changes

  • #7141 3a1b39a Thanks @​joshbermanssw! - Update @radix-ui/* dependencies to their latest patch/minor releases and remove the unused @radix-ui/react-checkbox dependency

  • #7140 de4a807 Thanks @​joshbermanssw! - Add a PostHog editorial-workflow-save event that records which save option was used in the "Save changes to new branch" modal (draft, ready for review, or publish), whether the save succeeded, and the failure reason when it didn't.

  • #7138 8497110 Thanks @​joshbermanssw! - Editorial workflow: replace the draft / ready-for-review toggle in the "Save changes to new branch" modal with a save-options dropdown (Save draft, Save (ready for review), Save and publish). The split button's main action reflects the editor's last choice (default Save draft, remembered via localStorage), and Save and publish is disabled with a tooltip on protected branches.

... (truncated)

Changelog

Sourced from tinacms's changelog.

3.11.0

Minor Changes

  • #7235 908fe7d Thanks @​joshbermanssw! - Editorial-workflow saves (Save draft / Save to a new branch, and the media create-branch flow) now run a single branch-list lookup instead of two sequential ones, roughly halving the delay before the progress modal appears.

Patch Changes

  • #7194 711ba30 Thanks @​kulesy! - Button now renders the shared loading-dots indicator automatically when busy, so every busy button gets a consistent spinner instead of each call site wiring its own (and some, like the account password form, were missing it entirely). The dots inherit the button text color so they stay visible across variants.

  • #7161 566af78 Thanks @​ahfoysal! - Keep folder collection views open when they only contain one document.

  • #7251 b8df6ee Thanks @​kulesy! - Fix the rich-text link popover not appearing when adding or editing a link.

    Since the popover was moved into a portal on document.body, plate-floating's inline z-index: 50 overrode its z-[999999] class, so it rendered behind the form field wrappers (which use z-index up to 1000) and was invisible. It now sits above them, so clicking the link button shows the URL input as expected.

  • #7204 59efccc Thanks @​joshbermanssw! - Show a clear error when repo-based media is used with a self-hosted site, instead of a misleading "Bad Route" message.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [cdbf469, 056ffc2]:

    • @​tinacms/bridge@​0.3.1
    • @​tinacms/mdx@​2.1.11
    • @​tinacms/search@​1.2.23

3.10.1

Patch Changes

  • Updated dependencies [4b4e139]:
    • @​tinacms/mdx@​2.1.10
    • @​tinacms/search@​1.2.22

3.10.0

Minor Changes

Patch Changes

  • #7141 3a1b39a Thanks @​joshbermanssw! - Update @radix-ui/* dependencies to their latest patch/minor releases and remove the unused @radix-ui/react-checkbox dependency

  • #7140 de4a807 Thanks @​joshbermanssw! - Add a PostHog editorial-workflow-save event that records which save option was used in the "Save changes to new branch" modal (draft, ready for review, or publish), whether the save succeeded, and the failure reason when it didn't.

... (truncated)

Commits
  • b636a22 Version Packages (#7205)
  • 566af78 Fix folder collection auto-open (#7161)
  • 908fe7d ⚡ Collapse editorial-workflow branch guard to a single branch-list fetch (#7235)
  • b8df6ee fix(tinacms): show the rich-text link popover above form fields (#7251)
  • 056ffc2 🐛 Publish internal package refs as ranges, not exact pins (~320 MB of duplica...
  • 59efccc 🐛 Show a clear error for repo-based media on self-hosted sites (#7204)
  • 711ba30 refactor(tinacms): render loading dots automatically on busy buttons (#7194)
  • adeafbc Version Packages (#7174)
  • a1ebeda Version Packages (#7130)
  • ff10e65 fix(tinacms): reject invalid folder names inline via shared relativePath allo...
  • Additional commits viewable in compare view

Updates @tinacms/cli from 2.1.5 to 2.5.6

Release notes

Sourced from @​tinacms/cli's releases.

@​tinacms/cli@​2.5.6

Patch Changes

  • #7176 5daa624 Thanks @​joshbermanssw! - Improve the error message when the CLI cannot resolve tinacms or a @tinacms/* package while building your Tina config or database. It now names the package that failed, reports the directory Tina searched from, and points at parent-directory package-manager files (package.json, node_modules, yarn.lock, .pnp.cjs) that can hijack module resolution. esbuild package resolution is also anchored at the project root.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [711ba30, 908fe7d, 566af78, b8df6ee, 59efccc, 056ffc2]:

    • tinacms@3.11.0
    • @​tinacms/app@​2.5.10
    • @​tinacms/graphql@​2.4.9
    • @​tinacms/search@​1.2.23

@​tinacms/cli@​2.5.5

Patch Changes

  • Updated dependencies []:
    • @​tinacms/app@​2.5.9
    • @​tinacms/graphql@​2.4.8
    • tinacms@3.10.1
    • @​tinacms/search@​1.2.22

@​tinacms/cli@​2.5.4

Patch Changes

  • #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

    Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

@​tinacms/cli@​2.5.3

Patch Changes

@​tinacms/cli@​2.5.2

Patch Changes

... (truncated)

Changelog

Sourced from @​tinacms/cli's changelog.

2.5.6

Patch Changes

  • #7176 5daa624 Thanks @​joshbermanssw! - Improve the error message when the CLI cannot resolve tinacms or a @tinacms/* package while building your Tina config or database. It now names the package that failed, reports the directory Tina searched from, and points at parent-directory package-manager files (package.json, node_modules, yarn.lock, .pnp.cjs) that can hijack module resolution. esbuild package resolution is also anchored at the project root.

  • #7213 056ffc2 Thanks @​wicksipedia! - Publish internal package references as ranges instead of exact versions.

    Internal dependencies were declared as workspace:*, which pnpm expands to an exact version when publishing ("tinacms": "3.10.0"), not a range. An exact pin cannot deduplicate against the version a consumer has already installed, so npm nests a second — and third — complete copy of tinacms and its dependency tree. In a stock Astro + TinaCMS blog this produced three copies of tinacms, three of mermaid (186 MB), five of date-fns (151 MB), and four of typescript (88 MB): about 320 MB of duplication.

    The same expansion applied to peerDependencies, so packages such as next-tinacms-cloudinary and tinacms-authjs published "tinacms": "3.10.0" as a peer — requiring consumers to have that exact version or hit an ERESOLVE conflict, and forcing a republish of every dependent on each tinacms release.

    Switching these to workspace:^ publishes them as caret ranges (^3.10.0), which deduplicate normally and let onlyUpdatePeerDependentsWhenOutOfRange do its job.

  • Updated dependencies [711ba30, 908fe7d, 566af78, b8df6ee, 59efccc, 056ffc2]:

    • tinacms@3.11.0
    • @​tinacms/app@​2.5.10
    • @​tinacms/graphql@​2.4.9
    • @​tinacms/search@​1.2.23

2.5.5

Patch Changes

  • Updated dependencies []:
    • @​tinacms/app@​2.5.9
    • @​tinacms/graphql@​2.4.8
    • tinacms@3.10.1
    • @​tinacms/search@​1.2.22

2.5.4

Patch Changes

  • #7168 0a927a4 Thanks @​Aibono1225! - Security fix: TinaCloud authorization is now scoped to the site's own configured clientID instead of a value read from the request. isAuthorized takes an optional expectedClientID (falling back to NEXT_PUBLIC_TINA_CLIENT_ID) and refuses when neither resolves. TinaCloudBackendAuthProvider, the next-tinacms-azure adapter, and the tinacms init template all pass the site clientID through.

    Action required (self-hosted). Authorization now fails closed when the site's clientID cannot be resolved at runtime. Ensure NEXT_PUBLIC_TINA_CLIENT_ID is present in the server runtime (not only inlined at build time), or pass the clientID explicitly to TinaCloudBackendAuthProvider(...) and to media-store authorized callbacks, e.g. isAuthorized(req, process.env.NEXT_PUBLIC_TINA_CLIENT_ID). If it cannot be resolved, backend and media authorization will return 401.

2.5.3

Patch Changes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

@dependabot
[DEPENDABOT] Weekly npm updates(deps): Bump mermaid, tinacms and @tin…
760edb7 
…acms/cli

Bumps [mermaid](https://github.com/mermaid-js/mermaid) to 11.16.1 and updates ancestor dependencies [mermaid](https://github.com/mermaid-js/mermaid), [tinacms](https://github.com/tinacms/tinacms/tree/HEAD/packages/tinacms) and [@tinacms/cli](https://github.com/tinacms/tinacms/tree/HEAD/packages/@tinacms/cli). These dependencies need to be updated together.


Updates `mermaid` from 9.3.0 to 11.16.1
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/v9.3.0...mermaid@11.16.1)

Updates `tinacms` from 3.4.1 to 3.11.0
- [Release notes](https://github.com/tinacms/tinacms/releases)
- [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/tinacms/CHANGELOG.md)
- [Commits](https://github.com/tinacms/tinacms/commits/tinacms@3.11.0/packages/tinacms)

Updates `@tinacms/cli` from 2.1.5 to 2.5.6
- [Release notes](https://github.com/tinacms/tinacms/releases)
- [Changelog](https://github.com/tinacms/tinacms/blob/main/packages/@tinacms/cli/CHANGELOG.md)
- [Commits](https://github.com/tinacms/tinacms/commits/@tinacms/cli@2.5.6/packages/@tinacms/cli)

---
updated-dependencies:
- dependency-name: mermaid
  dependency-version: 11.16.1
  dependency-type: indirect
- dependency-name: tinacms
  dependency-version: 3.11.0
  dependency-type: direct:production
- dependency-name: "@tinacms/cli"
  dependency-version: 2.5.6
  dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Aug 6, 2026
@github-actions

github-actions Bot commented Aug 6, 2026

Copy link
Copy Markdown

🔍 PR Change Explainer

This automated summary helps you understand what this PR changes and how it affects filecoin.io.

📊 Quick Stats
Files changed 2
Lines added +1403
Lines removed -914

📝 What Changed (Plain Language)

This is a configuration change. It modifies build settings, dependencies, or project configuration.

📂 Detailed File Breakdown

Click to expand full file list

filecoin.io (filecoin-site)

Config:

  • apps/filecoin-site/package.json

Root / Config

  • package-lock.json

🚀 Preview & Next Steps

  1. Wait for the Vercel preview — a preview link will appear in this PR as a separate comment from the Vercel bot
  2. Click the preview link to see exactly how your changes look on the live site
  3. Test your changes:
  4. Check the status checks below — all checks should pass (green checkmarks) before merging
  5. When ready, request a review or merge the PR
📖 Glossary (click to expand)
Term What it means
PR (Pull Request) A proposed set of changes waiting to be merged into the main website
Preview deployment A temporary version of the website showing your changes (not public)
Merge Applying your changes to the main website — this triggers a production deploy
Build The process of converting code into a working website
Status checks Automated tests that verify your changes don't break anything
Content file (.md) A Markdown file containing text content (blog posts, case studies, etc.)
Component (.tsx) A reusable piece of the website's UI (buttons, cards, headers, etc.)
Frontmatter The metadata at the top of content files (title, date, description, etc.)
Shared package Code in packages/ used across the site — changes here can affect many pages

🤖 This comment was generated automatically to help explain PR changes. If something looks wrong, ask a developer for help.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants