build(deps): bump katex and mermaid

[dependabot]

Bumps katex and mermaid. These dependencies needed to be updated together.
Updates katex from 0.16.45 to 0.18.10

Release notes

Sourced from katex's releases.

v0.18.10

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

v0.18.9

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

v0.18.8

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

v0.18.7

0.18.7 (2026-09-06)

Features

• add \reflectbox and \mapsfrom support (#4262) (ab509fd)

v0.18.6

0.18.6 (2026-09-05)

Bug Fixes

• array: preserve tags on empty final rows (#4277) (02d552c)

v0.18.5

0.18.5 (2026-08-31)

Bug Fixes

• char: accept U+10FFFF (#4265) (6805538), closes #2549

v0.18.4

0.18.4 (2026-08-10)

... (truncated)

Changelog

Sourced from katex's changelog.

0.18.10 (2026-09-30)

Features

• make KaTeX fallback to browsr math font before Times New Roman (#4298) (a477b2e)

0.18.9 (2026-09-23)

Features

• types: add contrib module declarations (#4250) (aafa187)

0.18.8 (2026-09-23)

Bug Fixes

• array: preserve trailing rows in align (#4283) (ddfcc29)

0.18.7 (2026-09-06)

Features

• add \reflectbox and \mapsfrom support (#4262) (ab509fd)

0.18.6 (2026-09-05)

Bug Fixes

• array: preserve tags on empty final rows (#4277) (02d552c)

0.18.5 (2026-08-31)

Bug Fixes

• char: accept U+10FFFF (#4265) (6805538), closes #2549

0.18.4 (2026-08-10)

Bug Fixes

• environment: report invalid environment names as ParseError (#4256) (e507f75), closes #3760 #3760

0.18.3 (2026-08-09)

... (truncated)

Commits

• 411da70 chore(release): 0.18.10 [ci skip]
• a477b2e feat: make KaTeX fallback to browsr math font before Times New Roman (#4298)
• 5a6a8f8 chore(deps): bump github/codeql-action from 4.38.1 to 4.38.2 (#4297)
• 71a7bc0 chore(release): 0.18.9 [ci skip]
• aafa187 feat(types): add contrib module declarations (#4250)
• e749fd1 chore(release): 0.18.8 [ci skip]
• ddfcc29 fix(array): preserve trailing rows in align (#4283)
• 96e751c chore(deps): bump github/codeql-action from 4.38.0 to 4.38.1 (#4292)
• 726c2d4 chore(deps): bump github/codeql-action from 4.37.9 to 4.38.0 (#4287)
• f71045d chore(deps): update dependency js-yaml to v4.3.2 [security] (#4286)
• Additional commits viewable in compare view

Install script changes

This version adds prepare script that runs during installation. Review the package contents before updating.

Updates mermaid from 11.15.0 to 12.2.0

Release notes

Sourced from mermaid's releases.

mermaid@12.2.0

Minor Changes

• #8394 6ac38cb Thanks @​jackroberts236! - feat: Add opt-in mindmap coloring by hierarchy depth using mindmap.colorBy: depth and the existing theme palette.

Patch Changes

• #8409 419ee68 Thanks @​ashishjain0512! - fix: size circle and double-circle nodes from their label instead of minNodeWidth, and trim neo circle padding

• #8395 2fb3ff1 Thanks @​ashishjain0512! - fix: ELK no longer straightens an edge terminal when that would put a label over another edge, or an edge through a label

• #8394 cbf89ab Thanks @​jackroberts236! - fix: Keep mindmap HTML labels readable in the neo look on themes that repaint node backgrounds

• #8390 430ac9b Thanks @​ashishjain0512! - fix: Centre mindmap node labels when htmlLabels is false

• #8161 d7532ed Thanks @​filipsajdak! - fix: scope a swimlane cluster's DOM id like every other cluster, so two diagrams on one page do not collide

• #8270 ad8d61a Thanks @​filipsajdak! - fix(rendering): clip an edge for the layout engine that drew it, so a diagram pinning its own engine (bpmn, swimlanes) still renders when the configured default is another one

• #8383 9d41c0f Thanks @​filipsajdak! - fix(swimlanes): split shared terminal lanes again after crossing cleanup, so an edge that detours around another lane no longer ends on the same attachment point as a neighbouring edge

• #8384 6c67397 Thanks @​filipsajdak! - fix(swimlanes): move a lane's title band clear of an edge that crosses it, in LR diagrams whose lanes carry no direction of their own and when the edge runs along the band's border

• #8366 40124c3 Thanks @​SwastikTripathi! - fix: swimlane nodes with no edges keep their source order inside a lane instead of being sorted by ID

mermaid@12.1.0

Minor Changes

• #8303 9140716 Thanks @​filipsajdak! - feat: add the elk.orientFeedbackEdges option, enabled by default. With the ELK layout, an edge from a node that a subgraph feeds back into that subgraph is now routed downstream instead of around the subgraph. This changes the layout of existing ELK diagrams that contain such edges; set elk.orientFeedbackEdges: false to keep the previous routing.

• #8250 fd4f5f2 Thanks @​kartben! - feat: add a bitOrder option to packet diagrams. It defaults to ascending, which is the current behaviour, and descending mirrors every row so it reads from that row's highest bit down to its lowest. Fields are still declared lowest bit first and keep their width, so switching a diagram between the two conventions only means changing bitOrder.

Patch Changes

• #8330 50c9e55 Thanks @​ashishjain0512! - fix: upgrade chevrotain to 13 so mermaid no longer pulls in vulnerable lodash-es@4.17.23

• #8259 4c90f5c Thanks @​afonsojanu! - fix(sequence): allow whitespace between an actor name and its @{ ... } config object

  participant Bob@{ "type" : "database" } parsed fine, but adding a single space before the config object (participant Bob @{ "type" : "database" }) failed with a confusing parse error, even though the plain form without a config object tolerates trailing whitespace just fine.

• #8339 c7fa1a5 Thanks @​ashishjain0512! - fix: keep ELK class-diagram cardinalities off namespace frames

• #8334 d67331d Thanks @​ashishjain0512! - fix(class): place cardinality labels beside their relation ends on dagre's sides with ELK, centre dagre's end labels, and stop clipping their text

• #8344 99a050b Thanks @​pbrolin47! - fix: with the ELK layout, an edge label could sit up to 16px beside its edge instead of centred on it, when the edge's terminal jog was straightened after the label's position was computed. The label is now re-projected onto the straightened route

... (truncated)

Commits

• 1fb7869 Merge pull request #8432 from mermaid-js/changeset-release/master
• 34772ca Version Packages
• 42292ea Merge pull request #8428 from mermaid-js/release/12.2.0
• e6c8059 Wrong version set previously
• 6c55f56 Set mermaid version when Coloring by depth supported in Mindmap
• 5a0d8cf Fix missing parallel uploads
• 788f396 Update according to discussion with core-team members
• 33d0a49 Merge pull request #8411 from mermaid-js/renovate/npm-katex-vulnerability
• 6538fde Update dependency katex to ^0.18.0 [SECURITY]
• ba3022d Merge pull request #8398 from mermaid-js/pebr/12.1.0-tmp
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.