The Security Fix That Would Have Silently Broken My Feature
I recently shipped Mermaid diagram support to Forem, the open source platform that powers DEV. Fenced mermaid code blocks now render as actual diagrams instead of plain highlighted source. Which means this renders, right here, on this post: flowchart TD A[CodeQL flags innerHTML] --> B[Add DOMPurify] B --> C{Measure the output} C -->|assumed| D[Ship it] C -->|actually| E[Labels are gone] E --> F[Find the real bug] The feature itself is not the interesting part. The interesting
