Bug 2064523 - Bump mermaid from 10.9.8 to 12.2.0

[dklawren]

No description provided.

[Copilot]

🟡 Changes recommended

Mermaid 12 requires Node 22.12+, while the asset build still uses Node 20.

0 open findings

What changed in this PR

Upgrades Mermaid from 10.9.8 to 12.2.0 and refreshes its dependency tree.

Changes:

• Bumps Mermaid and transitive dependencies.
• Updates guidance for future Mermaid major upgrades.

File	Description
README.rst	Updates upgrade guidance.
package.json	Pins Mermaid 12.2.0.
package-lock.json	Refreshes Mermaid’s dependency tree.
.github/​dependabot.yml	Defers Mermaid 13.x updates.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🔵 Needs a closer look

Mermaid 12.2.0 has not yet satisfied the repository’s seven-day dependency cooldown.

0 open findings

Previously missed (1)

In code that hasn't changed since last review

Defer Mermaid 12.2.0 bump until dependency cooldown expires

package.json:19

Mermaid 12.2.0 was published on 2026-10-13, only one day before this review. That bypasses the repository's seven-day dependency cooldown in .github/dependabot.yml:11-14, whose stated purpose is to avoid releases that are yanked or immediately patched. Please defer this bump until the cooldown expires, or use an eligible 12.x release and regenerate the lockfile.

🧠 Review effort: Balanced

[dklawren]

🔵 Needs a closer look

Mermaid 12.2.0 has not yet satisfied the repository’s seven-day dependency cooldown.

0 open findings
Previously missed (1)

🧠 Review effort: Balanced

This is a deliberate manual bump, so the cooldown doesn't apply. cooldown.default-days only delays the PRs Dependabot opens itself.

I looked at pinning to 12.1.0 (12 days old) to stay within the cooldown. The catch is that 12.1.0 depends on katex ^0.16.47, and that brings back GHSA-238p-pmpm-9mq7, which affects katex below 0.18.2. 12.2.0 moves katex to 0.18.x and npm audit comes back clean. The one 12.1.0 regression fixed in 12.2.0 (#8395) is ELK-only, and the dependency graph uses dagre, so the downgrade would gain us nothing. Keeping 12.2.0.