From 846c15e23630338357ed618b7505cd538114ff45 Mon Sep 17 00:00:00 2001 From: TsunamiNoAi Date: Fri, 7 Aug 2026 13:25:48 -0400 Subject: [PATCH 1/3] chore: bump pozeiden v0.2.0 -> v0.4.0 Picks up pozeiden's two 0.3.0 security fixes that the CLI/WASM mermaid paths were missing (GHSA-p2c5-qmq5-3r4f SVG/XSS injection, GHSA-rg4m-w3p2-gf3p out-of-bounds writes) plus the 0.4.0 hardening, accessibility metadata, and layout rewrite. Behaviour change per pozeiden's stability policy: emitted mermaid SVG bytes change (wider default font stack; accTitle/accDescr become /<desc>). Verified: zig build test, zig build (CLI renders a mermaid pie through pozeiden 0.4.0), zig build wasm; zon2json-lock regenerated (also picks up pozeiden's corrected transitive mvzr ref pin). --- CHANGELOG.md | 10 ++++++++++ build.zig.zon | 4 ++-- build.zig.zon2json-lock | 8 ++++---- 3 files changed, 16 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 104e559..574d155 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,16 @@ same stability guarantee. ## [Unreleased] +### Changed + +- Bumped the lazy `pozeiden` dependency v0.2.0 → v0.4.0, picking up its two + 0.3.0 security fixes (GHSA-p2c5-qmq5-3r4f SVG/XSS injection, + GHSA-rg4m-w3p2-gf3p out-of-bounds writes) plus the 0.4.0 hardening and + layout work. **Behaviour change:** mermaid SVG emitted by the CLI/WASM + paths changes bytes — the default font stack now ends in + `Liberation Sans, DejaVu Sans, sans-serif`, and `accTitle:`/`accDescr:` + directives become SVG `<title>`/`<desc>` accessibility metadata. + ## [0.11.0] — 2026-07-23 ### Added diff --git a/build.zig.zon b/build.zig.zon index c12097a..0974cae 100644 --- a/build.zig.zon +++ b/build.zig.zon @@ -62,8 +62,8 @@ // The CLI and WASM builds use it for mermaid rendering; falls back to // noop_mermaid.zig when pozeiden is unavailable. .pozeiden = .{ - .url = "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.2.0.tar.gz", - .hash = "pozeiden-0.2.0-NAqiXaypCgBCkAMB3WZpGLPnwV5XTsUvOf3KUY9aAN0p", + .url = "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.0.tar.gz", + .hash = "pozeiden-0.4.0-NAqiXYMXCwCzyp6k5efqAnjQ9j_0CWeuyJcw62yfnWxK", .lazy = true, }, .yaml = .{ diff --git a/build.zig.zon2json-lock b/build.zig.zon2json-lock index 203c788..eef52e6 100644 --- a/build.zig.zon2json-lock +++ b/build.zig.zon2json-lock @@ -29,14 +29,14 @@ "url": "git+https://github.com/github/cmark-gfm.git#587a12bb54d95ac37241377e6ddc93ea0e45439b", "hash": "sha256-egCWzw09e5daT8cnlSORC3gep9soiqonVC4GQ/s3voM=" }, - "pozeiden-0.2.0-NAqiXaypCgBCkAMB3WZpGLPnwV5XTsUvOf3KUY9aAN0p": { + "pozeiden-0.4.0-NAqiXYMXCwCzyp6k5efqAnjQ9j_0CWeuyJcw62yfnWxK": { "name": "pozeiden", - "url": "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.2.0.tar.gz", - "hash": "sha256-9j8xkNndJX+l20+/qlfK2aLFCfPQsX1xoTDQ+V2jXUg=" + "url": "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.0.tar.gz", + "hash": "sha256-uvGGJICGYLTqqDnOQcakvn3ft2MEcj5OmLP0puS4g/g=" }, "mvzr-0.3.9-ZSOky8FzAQBQ9-GkQnaLjOZZHxrioD8NwY-QyZT6oAyR": { "name": "mvzr", - "url": "git+https://github.com/mnemnion/mvzr?ref=v0.3.10#dd0e1bd2d6b10f9650317b30baef7ab7bc9dd9ec", + "url": "git+https://github.com/mnemnion/mvzr?ref=v0.3.9#dd0e1bd2d6b10f9650317b30baef7ab7bc9dd9ec", "hash": "sha256-hUGdJPjC1PAm6zWL9eAE7A+wAfzf6Q7uSutT2Xe7EMU=" }, "zig_yaml-0.3.2-C1161q3CAgCEpqWl_MKjkQpPZmos4DHBJewpb58XMcAL": { From 0e52efb824312d1fd8abd8683fda0c1c0513297a Mon Sep 17 00:00:00 2001 From: TsunamiNoAi <spam@falseblue.com> Date: Fri, 7 Aug 2026 15:20:23 -0400 Subject: [PATCH 2/3] chore: bump pozeiden to v0.4.1 and update related references --- build.zig.zon | 4 ++-- build.zig.zon2json-lock | 6 +++--- flake.nix | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/build.zig.zon b/build.zig.zon index 0974cae..244a066 100644 --- a/build.zig.zon +++ b/build.zig.zon @@ -62,8 +62,8 @@ // The CLI and WASM builds use it for mermaid rendering; falls back to // noop_mermaid.zig when pozeiden is unavailable. .pozeiden = .{ - .url = "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.0.tar.gz", - .hash = "pozeiden-0.4.0-NAqiXYMXCwCzyp6k5efqAnjQ9j_0CWeuyJcw62yfnWxK", + .url = "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.1.tar.gz", + .hash = "pozeiden-0.4.1-NAqiXUkfCwBbeMXQus5ba8zxE3oEyZtnD_OtL_35qKi8", .lazy = true, }, .yaml = .{ diff --git a/build.zig.zon2json-lock b/build.zig.zon2json-lock index eef52e6..4e820d5 100644 --- a/build.zig.zon2json-lock +++ b/build.zig.zon2json-lock @@ -29,10 +29,10 @@ "url": "git+https://github.com/github/cmark-gfm.git#587a12bb54d95ac37241377e6ddc93ea0e45439b", "hash": "sha256-egCWzw09e5daT8cnlSORC3gep9soiqonVC4GQ/s3voM=" }, - "pozeiden-0.4.0-NAqiXYMXCwCzyp6k5efqAnjQ9j_0CWeuyJcw62yfnWxK": { + "pozeiden-0.4.1-NAqiXUkfCwBbeMXQus5ba8zxE3oEyZtnD_OtL_35qKi8": { "name": "pozeiden", - "url": "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.0.tar.gz", - "hash": "sha256-uvGGJICGYLTqqDnOQcakvn3ft2MEcj5OmLP0puS4g/g=" + "url": "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.1.tar.gz", + "hash": "sha256-JRF9suGxbgmYBSkkfgJjiQB57fi5itR6B2RfNNbYMtw=" }, "mvzr-0.3.9-ZSOky8FzAQBQ9-GkQnaLjOZZHxrioD8NwY-QyZT6oAyR": { "name": "mvzr", diff --git a/flake.nix b/flake.nix index 6d5a9a1..d1d2e6d 100644 --- a/flake.nix +++ b/flake.nix @@ -149,7 +149,7 @@ text = '' PORT="''${1:-8080}" echo "▸ Starting fuzzer — web UI at http://127.0.0.1:$PORT" - zig build --listen fuzz --fuzz --webui="127.0.0.1:$PORT" + zig build fuzz --fuzz --webui="127.0.0.1:$PORT" ''; }; in { From f9316e3ad46f51785a5b02eae1742ce44d1510ee Mon Sep 17 00:00:00 2001 From: TsunamiNoAi <spam@falseblue.com> Date: Fri, 7 Aug 2026 15:20:39 -0400 Subject: [PATCH 3/3] chore: release 0.11.1 --- CHANGELOG.md | 2 ++ build.zig.zon | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 574d155..2f41e2e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -8,6 +8,8 @@ same stability guarantee. ## [Unreleased] +## [0.11.1] — 2026-08-07 + ### Changed - Bumped the lazy `pozeiden` dependency v0.2.0 → v0.4.0, picking up its two diff --git a/build.zig.zon b/build.zig.zon index 244a066..a2a31a1 100644 --- a/build.zig.zon +++ b/build.zig.zon @@ -9,7 +9,7 @@ .name = .zigmark, // This is a [Semantic Version](https://semver.org/). // In a future version of Zig it will be used for package deduplication. - .version = "0.11.0", + .version = "0.11.1", // Together with name, this represents a globally unique package // identifier. This field is generated by the Zig toolchain when the // package is first created, and then *never changes*. This allows