chore(deps): update yuzutech/kroki-bpmn docker tag to v0.32.1

[renovate]

This PR contains the following updates:

Package	Update	Change
yuzutech/kroki-bpmn (source)	minor	0.30.1 → 0.32.1

---

Release Notes

yuzutech/kroki (yuzutech/kroki-bpmn)

v0.32.1

Compare Source

Security

• Prevent Vega diagrams from bypassing KROKI_SAFE_MODE=SECURE's URL-loading restriction: the guard only inspected spec.data and the direct children of spec.marks, so a URL-bearing data definition nested inside a group mark (marks[].marks[].data[].url) reached Vega's loader unchecked, allowing SSRF and local file reads (e.g. file:///etc/passwd); separately, an image mark's encode.*.url (e.g. encode.enter.url) is fetched directly by the renderer and wasn't inspected at all, allowing SSRF (e.g. against cloud metadata endpoints) even without any data block. Fixed by recursively scanning every mark, however deeply nested, for a url on either data or encode

Diagram libraries

• Update bpmn-js to 18.22.1

v0.32.0

Compare Source

Added

• Add background and transparent options to Ditaa diagrams, to set the background colour of the image or make it transparent

Security

• Prevent unauthenticated remote code execution on /tikz/svg via \special{ps:...}: dvisvgm hands PostScript specials embedded in the DVI off to Ghostscript, which dvisvgm starts with -dDELAYSAFER instead of -dSAFER, leaving the %pipe% device available and allowing arbitrary command execution regardless of KROKI_SAFE_MODE — including SECURE, since that setting only restricts kpathsea (LaTeX) file access and has no effect on Ghostscript. Fixed by passing --no-specials=ps to dvisvgm so PostScript specials are never processed
• Prevent BPMN diagram source from executing arbitrary HTML/JavaScript in the companion's headless Chromium page: the diagram source was assigned to the rendering container via innerHTML before being handed to bpmn-js, so a crafted request to /bpmn/svg could inject an element (e.g. <img onerror=...>) that ran script in that page; combined with the browser's --disable-web-security flag (same-origin policy disabled), that script could issue cross-origin requests and read the responses. Fixed by clearing the container instead of parsing the diagram source as HTML, and by dropping --disable-web-security — the only reason it was set, local file access, is already covered by the shared --allow-file-access-from-files flag (#​2089)

Changed

• Update Node.js base Docker images to 24.18 (Alpine 3.24) for the Mermaid, BPMN, Excalidraw and diagrams.net companions

Fixed

• Prevent the headless Chromium instance shared by the Mermaid, BPMN, Excalidraw and diagrams.net companions from crashing once it exhausts Docker's default 64MB /dev/shm, by passing --disable-dev-shm-usage so Chromium falls back to /tmp
• Raise the core's HTTP connection pool towards each companion from Vert.x's default of 5 to 10 (configurable via KROKI_DELEGATE_MAX_POOL_SIZE), so a degraded companion (e.g. Mermaid restarting Chromium after a crash) doesn't starve unrelated requests of a pooled connection and fail them with a getting a connection timeout before the companion itself is actually overloaded

Diagram libraries

• Update Vega to 6.3.1
• Update bpmn-js to 18.22.0 (#​2114)
• Update Mermaid to 11.16.0 (#​2119)
• Update WaveDrom to 3.6.2 (#​2122)

v0.31.2

Compare Source

Security

• Prevent TikZ diagrams in secure mode from reading arbitrary files on the container filesystem via \input, \include, \openin/\read, \lstinputlisting and similar LaTeX file-access primitives, by restricting kpathsea's openin_any/openout_any to the current working directory instead of only blocklisting \verbatiminput
• Prevent Mermaid flowchart image-shape nodes (N@{ img: "URL" }) from making the companion's headless Chromium fetch an attacker-controlled URL on /svg and /png, by wiring KROKI_MERMAID_SAFE_MODE/KROKI_SAFE_MODE into a shared Puppeteer request-interception policy (applyNetworkPolicy) that restricts requests to file:/data:/same-origin plus an optional operator-configured allowlist (KROKI_MERMAID_ALLOWED_ORIGINS / KROKI_ALLOWED_ORIGINS)

Changed

• Update Node.js base Docker images to 24.18 (Bookworm) (#​2097)

Fixed

• Cap concurrent Mermaid conversions (KROKI_MERMAID_MAX_CONCURRENCY, default 6) to bound Chromium memory usage; a burst of simultaneous requests could otherwise spin up enough renderer processes to exceed the container's memory limit and crash the service

Diagram libraries

• Update Structurizr to 6.2.2 (#​2099)

v0.31.1

Compare Source

Changed

• Update Node.js base Docker images to 24.18 (Alpine) and 24.17 (Bookworm) (#​2093)

Fixed

• Preserve leading whitespace of the first line in GoAT diagrams (#​2086)

Diagram libraries

• Update blockdiag to 3.4.2 (#​2085)

v0.31.0

Compare Source

This release adds support for GoAT diagrams and brings back the ELK and tidy-tree layouts in Mermaid 🎉

Added

• Integrate GoAT (Go ASCII diagrams) (#​2033)
• Support ELK and tidy-tree alternate layouts in Mermaid (#​2080)

Fixed

• Prevent browser leak and bound resource usage in companion containers (#​2076)

Diagram libraries

• blockdiag (actdiag, nwdiag, packetdiag, rackdiag, seqdiag) 3.3.0
• BPMN 18.18.0
• diagrams.net 29.6.1
• Excalidraw 0.18.1
• GraphViz 14.1.3
• Mermaid 11.15.0
• PlantUML (and C4) 1.2026.6
• Structurizr 6.2.1
• Vega-Lite 6.4.3
• WaveDrom 3.6.1

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.