yuzutech/kroki v0.32.0

on GitHub

Added

• Add background and transparent options to Ditaa diagrams, to set the background colour of the image or make it transparent

Security

• Prevent unauthenticated remote code execution on /tikz/svg via \special{ps:...}: dvisvgm hands PostScript specials embedded in the DVI off to Ghostscript, which dvisvgm starts with -dDELAYSAFER instead of -dSAFER, leaving the %pipe% device available and allowing arbitrary command execution regardless of KROKI_SAFE_MODE — including SECURE, since that setting only restricts kpathsea (LaTeX) file access and has no effect on Ghostscript. Fixed by passing --no-specials=ps to dvisvgm so PostScript specials are never processed
• Prevent BPMN diagram source from executing arbitrary HTML/JavaScript in the companion's headless Chromium page: the diagram source was assigned to the rendering container via innerHTML before being handed to bpmn-js, so a crafted request to /bpmn/svg could inject an element (e.g. <img onerror=...>) that ran script in that page; combined with the browser's --disable-web-security flag (same-origin policy disabled), that script could issue cross-origin requests and read the responses. Fixed by clearing the container instead of parsing the diagram source as HTML, and by dropping --disable-web-security — the only reason it was set, local file access, is already covered by the shared --allow-file-access-from-files flag (#2089)

Changed

• Update Node.js base Docker images to 24.18 (Alpine 3.24) for the Mermaid, BPMN, Excalidraw and diagrams.net companions

Fixed

• Prevent the headless Chromium instance shared by the Mermaid, BPMN, Excalidraw and diagrams.net companions from crashing once it exhausts Docker's default 64MB /dev/shm, by passing --disable-dev-shm-usage so Chromium falls back to /tmp
• Raise the core's HTTP connection pool towards each companion from Vert.x's default of 5 to 10 (configurable via KROKI_DELEGATE_MAX_POOL_SIZE), so a degraded companion (e.g. Mermaid restarting Chromium after a crash) doesn't starve unrelated requests of a pooled connection and fail them with a getting a connection timeout before the companion itself is actually overloaded

Diagram libraries

• Update Vega to 6.3.1
• Update bpmn-js to 18.22.0 (#2114)
• Update Mermaid to 11.16.0 (#2119)
• Update WaveDrom to 3.6.2 (#2122)

What's Changed

• feat(ditaa): add background and transparent options by @ggrossetie in #2106
• fix(security): 2 improvements across 2 files by @tomaioo in #2089
• chore(deps): update github actions by @ggrossetie in #2092
• fix(companions): prevent Chromium crashes and connection pool exhaustion by @ggrossetie in #2109
• chore(renovate): group npm updates per diagram library directory by @ggrossetie in #2110
• chore(deps): update dependency vega to v6.3.1 by @ggrossetie in #2111
• chore(deps): update Node.js base Docker images to alpine3.24 by @ggrossetie in #2113
• chore(deps): update dependency canvas to v3.2.3 by @ggrossetie in #2062
• chore(deps): update java dependencies to v1.6.0 by @ggrossetie in #2118
• chore(deps): update dbml by @ggrossetie in #2116
• chore(deps): update mermaid by @ggrossetie in #2119
• chore(deps): update nomnoml by @ggrossetie in #2120
• chore(deps): update excalidraw by @ggrossetie in #2117
• chore(deps): update bytefield by @ggrossetie in #2115
• chore(deps): update bpmn-js by @ggrossetie in #2114
• chore(deps): update wavedrom by @ggrossetie in #2122
• chore(deps): update rust docker tag to v1.97 by @ggrossetie in #2121

New Contributors

• @tomaioo made their first contribution in #2089

Full Changelog: v0.31.2...v0.32.0