chore(deps): bump the npm_and_yarn group across 1 directory with 4 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the /docs directory: brace-expansion, dompurify, ip-address and mermaid.

Updates brace-expansion from 1.1.15 to 1.1.18

Commits

• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
• 447763a 1.1.16
• d74e630 fix: v1 backport for CVE-2026-13149 (#122)
• See full diff in compare view

Updates dompurify from 3.4.12 to 3.4.14

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.14

• Fixed an issue with possible bypasses when risky tags are allow-listed, thanks @​AlirezaRouhbakhsh
• Fixed a couple of edge cases with mixed document contexts, thanks @​fishjojo1
• Added the SVG pointer-events and vector-effect presentation attributes to the allow-list, thanks @​Jaybhade
• Conducted another refactoring run, removed dead branches and duplicated logic, flattened attribute validation
• Updated the documentation in several spots, README, wiki, etc., thanks @​Akokonunes
• Updated several development dependencies and CI workflow actions

DOMPurify 3.4.13

• Fixed an issue with hook removal during IN_PLACE sanitization, thanks @​koyokr
• Fixed an issue with hooks potentially bypassing the clone guard, thanks @​AkshayjainG
• Fixed an issue with DOM clobbering via ownerDocument during IN_PLACE, thanks @​AkshayjainG
• Bumped several dependencies where possible

Commits

• 4e6fe24 release: 3.4.14 (#1587)
• 3067f77 release: 3.4.13 (#1562)
• See full diff in compare view

Updates ip-address from 10.2.0 to 10.7.0

Release notes

Sourced from ip-address's releases.

v10.7.0

What's Changed

• Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct the IPv6 end-address docs by @​beaugunderson in beaugunderson/ip-address#225

Full Changelog: beaugunderson/ip-address@v10.6.0...v10.7.0

v10.6.0

What's Changed

• Add isGlobal() and pin the classifiers to the IANA special-purpose registries by @​beaugunderson in beaugunderson/ip-address#224

Full Changelog: beaugunderson/ip-address@v10.5.1...v10.6.0

v10.5.1

Full Changelog: beaugunderson/ip-address@v10.5.0...v10.5.1

v10.5.0

What's Changed

• Honor the fromURL graceful-failure contract for non-IPv6 hosts by @​beaugunderson in beaugunderson/ip-address#218
• Correct the documentation where it disagreed with the library by @​beaugunderson in beaugunderson/ip-address#219

Full Changelog: beaugunderson/ip-address@v10.4.0...v10.5.0

v10.4.0

What's Changed

• Add GitHub Actions CI by @​beaugunderson in beaugunderson/ip-address#213
• Keep the package loadable on node 12, and enforce it by @​beaugunderson in beaugunderson/ip-address#216
• Validate the byte arrays Address6 is given by @​beaugunderson in beaugunderson/ip-address#217

Full Changelog: beaugunderson/ip-address@v10.3.1...v10.4.0

v10.3.1

Full Changelog: beaugunderson/ip-address@v10.3.0...v10.3.1

v10.3.0

Full Changelog: beaugunderson/ip-address@v10.2.2...v10.3.0

v10.2.2

Full Changelog: beaugunderson/ip-address@v10.2.1...v10.2.2

v10.2.1

Full Changelog: beaugunderson/ip-address@v10.2.0...v10.2.1

Commits

• 2b7cab5 10.7.0
• 87fae23 Add offset() and nextNetwork(), accept prefix-length ip6.arpa names, correct ...
• 42c1f8b 10.6.0
• fb12583 Add isGlobal() and pin the classifiers to the IANA special-purpose registries...
• 38b02d7 10.5.1
• d03e960 Merge commit from fork
• ab3dc88 Merge commit from fork
• ef98e0a 10.5.0
• 9fd1110 Correct the documentation where it disagreed with the library (#219)
• d478737 Honor the fromURL graceful-failure contract for non-IPv6 hosts (#218)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for ip-address since your current version.

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates mermaid from 11.16.0 to 11.17.2

Release notes

Sourced from mermaid's releases.

mermaid@11.17.2

Patch Changes

• #8125 178d7c7 Thanks @​knsv-bot! - fix: restore the edgePaths class on the edge group in rendered SVG, and point the flowchart, block and user journey stylesheets at it

mermaid@11.17.1

Patch Changes

• #8092 31ce60a Thanks @​pbrolin47! - fix(c4): wrap element labels to c4.width again

  C4 element labels (System, Container, Component, Person and their _Ext variants) stopped wrapping in 11.17.0, so long descriptions rendered on one unbroken line and the shape grew sideways well past the configured c4.width. The unified-shapes label helper gated wrapping on the root-level wrap option, which has no schema default and is therefore undefined; it now gates on c4.wrap (default true), which is what the legacy renderer used.

• #8088 c66200b Thanks @​ashishjain0512! - fix: neo-look arrowheads and crow's-foot markers no longer fall back to default theme colours/stroke widths on the first render with layout: elk. State diagram arrowheads stayed dark on dark themes, and ER / requirement markers were drawn at the default stroke width, because markers were created from the layout package's own bundled copy of mermaid, whose config had not been initialized yet.

• #8079 281cd7b Thanks @​ashishjain0512! - fix(class): class diagram relation markers (composition, aggregation, extension, dependency, lollipop) no longer scale with the edge stroke width, so they stay outside the class box boundary in themes that set strokeWidth: 2 (redux, redux-dark, redux-color, redux-dark-color, neo, neo-dark) with the default classic look.

mermaid@11.17.0

Minor Changes

• #7842 3670b4e Thanks @​filipsajdak! - feat(c4): render C4 elements through the unified shape system, using the new person shape

• #7812 cdfc0ea Thanks @​knsv-bot! - feat(class): route classDiagram to the unified (v2) renderer by default

  Set class: { defaultRenderer: 'dagre-d3' } in the config to restore the legacy renderer.

• #7785 c45cde9 Thanks @​knsv-bot! - feat(flowchart): add collapsible flowchart subgraphs via subgraphId@{ view: collapsed }

• #7828 8eb3afc Thanks @​knsv-bot! - feat(elk): add elk.keepEntryNodeOnTop config option to keep a recursive flow's entry node on top

• #7803 74e44eb Thanks @​knsv-bot! - feat(elk): add elk.nodePlacementAlignment config option

• #7792 ea55b31 Thanks @​RodrigojndSantos! - feat(er): add subgraph support to ER diagrams.

• #7970 a2c0fb6 Thanks @​filipsajdak! - feat(flowchart): add folder, bucket, console (terminal window) and browser shapes

• #7842 ae3e115 Thanks @​filipsajdak! - feat(flowchart): add person shape (circular head above a rounded body), usable in flowcharts via A@{ shape: person }

• #7724 0fd7a9f Thanks @​xdumaine! - feat(xyChart): add legends for named line and bar series

Patch Changes

• #7847 215fe89 Thanks @​filipsajdak! - fix(c4): named attributes such as $tags, $link and $sprite are no longer clobbered to undefined when they arrive in an earlier positional slot of Person/System/Container/Component/Boundary/Rel statements.

• #7871 8d874c4 Thanks @​knsv-bot! - fix(flowchart): stop dagre layout from spamming warn-level logs on every node/edge/cluster

• #8071 b3d1f63 Thanks @​pbrolin47! - fix(block): sibling blocks overlapping in block diagrams when one has a label wider than 200px

• #7870 71b8843 Thanks @​knsv-bot! - fix: a RangeError: Invalid array length crash when rendering certain edges.

• #7924 9cbef5d Thanks @​nightt5879! - fix(treeView): icons disappearing after strict security sanitization.

... (truncated)

Commits

• dcb694d Version Packages (#8130)
• 178d7c7 fix: restore edgePaths class on the edge group (#8125)
• 569f46e Version Packages (#8114)
• 3054836 Version Packages
• 5b17e0a Merge pull request #8092 from mermaid-js/hotfix/11.17.1
• 655211a Reverted change of wrap-options
• 8a23480 Updated doc from feedback
• 412c80a Update doc and consistent handlig in c4 as for seq diags
• b433a9a Updated changeset to describe specifik diagram affected
• 6bae15e Updated tests to Playwright API
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.