chore(deps): update dependency @excalidraw/excalidraw to v0.18.1 [security]

[ggrossetie]

This PR contains the following updates:

Package	Type	Update	Change
@excalidraw/excalidraw (source)	dependencies	patch	0.18.0 → 0.18.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Excalidraw vulnerable to XSS via Mermaid sequence diagram labels (KaTeX rendering)

GHSA-39h7-pwv7-rc3x

More information

Details

Impact

@excalidraw/excalidraw@0.18.0 depends on a Mermaid conversion package version that resolves to a Mermaid release affected by CVE-2025-54881 / GHSA-7rqq-prvp-x9jh. User-supplied Mermaid sequence diagram labels could trigger XSS through Mermaid’s KaTeX label rendering path.

This is patched in @excalidraw/excalidraw@0.18.1 by updating @excalidraw/mermaid-to-excalidraw to 2.2.2, which uses a patched Mermaid 11 release.

Moderate severity as this XSS requires manual user action - pasting unsafe Mermaid diagram into the Excalidraw editor. No semi-automated attack vector exists by default (such as accessing a link).

Patches

• Stable @excalidraw/excalidraw@0.18.1 is patched.
• Unstable @excalidraw/excalidraw@next has resolved to patched builds since @excalidraw/excalidraw@0.18.0-f29edf on 2025-08-21.
• Direct consumers of @excalidraw/mermaid-to-excalidraw should use 1.1.3 or later.

Workarounds

None.

Resources

• Upstream Mermaid advisory: GHSA-7rqq-prvp-x9jh
• CVE-2025-54881

Severity

Medium

References

• https://github.com/excalidraw/excalidraw/security/advisories/GHSA-39h7-pwv7-rc3x
• https://github.com/mermaid-js/mermaid/security/advisories/GHSA-7rqq-prvp-x9jh
• https://github.com/excalidraw/excalidraw/releases/tag/v0.18.1
• https://github.com/advisories/GHSA-39h7-pwv7-rc3x

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

excalidraw/excalidraw (@​excalidraw/excalidraw)

v0.18.1

Compare Source

Security patch release for @excalidraw/excalidraw@0.18.x, addressing upstream Mermaid XSS vulnerability CVE-2025-54881 / GHSA-7rqq-prvp-x9jh.

• Backports Mermaid XSS mitigation by updating @excalidraw/mermaid-to-excalidraw to 2.2.2
• Pins @types/d3-dispatch for compatibility with the 0.18.x TypeScript version

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • ""
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.