yuzutech/kroki v0.31.2

on GitHub

Security

• Prevent TikZ diagrams in secure mode from reading arbitrary files on the container filesystem via \input, \include, \openin/\read, \lstinputlisting and similar LaTeX file-access primitives, by restricting kpathsea's openin_any/openout_any to the current working directory instead of only blocklisting \verbatiminput
• Prevent Mermaid flowchart image-shape nodes (N@{ img: "URL" }) from making the companion's headless Chromium fetch an attacker-controlled URL on /svg and /png, by wiring KROKI_MERMAID_SAFE_MODE/KROKI_SAFE_MODE into a shared Puppeteer request-interception policy (applyNetworkPolicy) that restricts requests to file:/data:/same-origin plus an optional operator-configured allowlist (KROKI_MERMAID_ALLOWED_ORIGINS / KROKI_ALLOWED_ORIGINS)

Changed

• Update Node.js base Docker images to 24.18 (Bookworm) (#2097)

Fixed

• Cap concurrent Mermaid conversions (KROKI_MERMAID_MAX_CONCURRENCY, default 6) to bound Chromium memory usage; a burst of simultaneous requests could otherwise spin up enough renderer processes to exceed the container's memory limit and crash the service

Diagram libraries

• Update Structurizr to 6.2.2 (#2099)

What's Changed

• chore(renovate): track PlantUML version via dependency dashboard only by @ggrossetie in #2096
• chore(deps): update java dependencies by @ggrossetie in #2100
• chore(deps): update github actions (major) by @ggrossetie in #2101
• chore(deps): update structurizr packages to v6.2.2 by @ggrossetie in #2099
• chore(deps): update docker images by @ggrossetie in #2097
• chore(deps): update java testing packages to v6.1.2 by @ggrossetie in #2098
• fix(mermaid): cap concurrent conversions to bound Chromium memory usage by @ggrossetie in #2105

Full Changelog: v0.31.1...v0.31.2