Fix CVE-2026-71436 by updating mermaid to patched version

[sbouchet]

What does this PR do?

This PR fixes CVE-2026-71436
mermaid version is updated to 11.17.1

What issues does this PR fix?

https://redhat.atlassian.net/browse/CRW-12326

How to test this PR?

Does this PR contain changes that override default upstream Code-OSS behavior?

• the PR contains changes in the code folder (you can skip it if your changes are placed in a che extension )
• the corresponding items were added to the CHANGELOG.md file
• rules for automatic git rebase were added to the .rebase folder

Summary by CodeRabbit

• Improvements
  • Updated Mermaid support to version 11.17.1.
  • Improved compatibility and consistency for Mermaid diagrams in Markdown.

[github-actions]

Click here to review and test in web IDE:

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 44d0ae77-d081-449b-9a02-f664f3726a8b

📥 Commits

Reviewing files that changed from the base of the PR and between 1ede901 and 8792b78.

⛔ Files ignored due to path filters (2)

• code/extensions/markdown-language-features/package-lock.json is excluded by !**/package-lock.json
• code/extensions/mermaid-markdown-features/package-lock.json is excluded by !**/package-lock.json

📒 Files selected for processing (6)

• .rebase/CHANGELOG.md
• .rebase/override/code/extensions/markdown-language-features/package.json
• .rebase/override/code/extensions/mermaid-markdown-features/package.json
• code/extensions/markdown-language-features/package.json
• code/extensions/mermaid-markdown-features/package.json
• rebase.sh

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The pull request updates Mermaid dependencies from ^11.15.0 to ^11.17.1 in two extension manifests. It adds matching override package.json files for rebase operations. The rebase script now handles conflicts for the Mermaid Markdown features manifest. The changelog records these package manifest changes.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 8792b

This PR makes a localized Mermaid dependency update and related metadata changes to address the reported vulnerability; no actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: azatsarynnyy, rgrunber, romannikitenko

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is 57 characters, uses the imperative mood, and clearly describes updating Mermaid to fix the CVE.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Rebase Rules For Upstream Changes	✅ Passed	PASS. The pull-request side changes two in-scope files: code/extensions/markdown-language-features/package.json and code/extensions/mermaid-markdown-features/package.json; the changed `package-loc…

Full details: Rebase Rules For Upstream Changes

Explanation

PASS. The pull-request side changes two in-scope files: code/extensions/markdown-language-features/package.json and code/extensions/mermaid-markdown-features/package.json; the changed package-lock.json files are explicitly excluded. Matching .rebase/override/ rules exist for both package files. .rebase/CHANGELOG.md contains the PR 797 entry with both paths. rebase.sh contains conflict-routing branches for both paths, and the PR description marks all three required checklist items.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-797-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-797-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-797-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-797-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-797-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-797-dev-amd64

[github-actions]

Pull Request images published ✨

Editor amd64: quay.io/che-incubator-pull-requests/che-code:pr-797-amd64
Editor arm64: quay.io/che-incubator-pull-requests/che-code:pr-797-arm64
Dev image: quay.io/che-incubator-pull-requests/che-code-dev:pr-797-dev-amd64