How a One-Line Security Fix Nearly Silently Broke Mermaid Diagram Labels on Forem

·4 views

A developer shipping Mermaid diagram support to Forem, the open-source platform behind DEV Community, discovered that a seemingly straightforward security fix flagged by GitHub's CodeQL analysis would have quietly broken labels on most common diagram types without triggering any errors or test failures. The issue arose because applying DOMPurify sanitization with an SVG profile strips attributes like aria-label and title that Mermaid uses to render diagram labels. Forem's existing HTML scrubber also posed challenges, as the standard class attribute used by Mermaid is not on its allow list, requiring the developer to use data-lang instead. Additional complications included Forem's post-processors converting emoji shortcodes and @mentions inside diagram source, which was resolved by wrapping source text in a code node that post-processors skip. The developer ultimately implemented explicit DOMPurify sanitization with a carefully configured profile rather than relying solely on Mermaid's internal sanitization, avoiding a silent but damaging regression.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Google Adds Play Books Integration to Gemini Notebook for Source-Grounded AI Outputs

Google has expanded Gemini Notebook with a feature called Expert Intelligence, which allows users to use eligible ebooks they own through Google Play Books as grounded source material for AI interactions. The update enables Gemini Notebook to generate outputs such as answers, infographics, audio overviews, and quizzes by combining a user's owned books with their own documents. The initial catalog covers over 100,000 titles from major publishers, and the feature is described as a cross-Google effort developed in collaboration with authors and publishers. A key limitation applies to shared notebooks: collaborators must independently own the relevant book to engage with its content, meaning a single purchase cannot be extended to an entire team. Google plans to expand Expert Intelligence to additional sources and platforms, including the Gemini app and AI Mode in Search, over time.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

87% of Custom Claude Code Agents Went Unused for 30 Days, Wasting Tokens

A developer running an automated Claude Code setup discovered that seven of their eight custom-defined agents recorded zero invocations over a 30-day period from late May to August 2026. Only the code-reviewer agent was called even once, while specialists like architect, security-reviewer, and database-reviewer sat completely idle. The problem is structural: Claude Code injects all agent definitions into the system prompt on every request, meaning unused agents silently consume tokens and can degrade inference quality. Claude does not autonomously select agents based on their own descriptions — an agent only activates when explicitly invoked by a calling prompt or logic. The developer's takeaway is that agent utility should be measured through actual usage logs, not assumptions, and that unused definitions should be pruned regularly to reduce both token costs and management complexity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

EKS, ECS, or Fargate: How to Pick the Right AWS Container Setup

AWS offers two container orchestrators — ECS and EKS — each combinable with either EC2 or Fargate as the underlying compute, making these separate decisions that are often confused. ECS is AWS's simpler, cost-free control-plane option suited for small teams and AWS-only workloads, while EKS provides managed Kubernetes with a richer ecosystem but higher operational overhead. Fargate eliminates node management and suits variable or bursty workloads, whereas EC2 is more cost-effective for steady, high-volume or GPU-dependent tasks. For most teams running fewer than 20 services on AWS alone, ECS on Fargate is recommended as the practical default. EKS is better justified when Kubernetes expertise, multi-cloud portability, or a large service footprint makes the added complexity worthwhile.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

NotebookLM Short and Cinematic Video Overviews Limited to English Only

Google's NotebookLM platform offers multiple video overview formats, but its Short Video Overview and Cinematic Video Overview features currently support only English, according to official product documentation. The Short Video Overview generates roughly 60-second vertical videos from notebook sources, making it suitable for English-language internal briefings or quick content recaps. Businesses requiring multilingual video output should instead use the Explainer Video Overview format, which Google documents as supporting a broader range of languages. The distinction is critical for teams building content workflows around NotebookLM for education, internal communication, or customer-facing material. Google's expanded language support across some NotebookLM formats does not apply uniformly, so users are advised to verify language availability for each specific format before production.

0 comments Read more at DEV Community