chore: upgrade mermaid to ^11.16.1 to address CVE-2026-50159, CVE-2026-71436, CVE-2026-71437, CVE-2026-71438, CVE-2026-71439

[claude]

Fixes SOU-1894
Fixes SOU-1895
Fixes SOU-1896
Fixes SOU-1897
Fixes SOU-1898

Refreshes the yarn.lock entry for mermaid from 11.16.0 to 11.16.1. The existing ^11.16.0 range in packages/web/package.json already admits the patched release, so no manifest change or resolutions override is needed.

Advisories addressed

Advisory	Summary
CVE-2026-50159	CSS injection applying to sibling elements of the diagram
CVE-2026-71436	XY Charts infinite loop DoS
CVE-2026-71437	Architecture diagrams prototype pollution
CVE-2026-71438	Configuration APIs prototype pollution
CVE-2026-71439	Radar diagrams DoS

All are fixed in mermaid@11.16.1.

Verification

• yarn why mermaid reports a single instance, mermaid@npm:11.16.1, with no affected version remaining in the graph.
• yarn install completes with no further lockfile churn.
• yarn workspace @sourcebot/web test --run: 101 files, 1191 tests passed.

🤖 Generated with Claude Code

---

Note

Low Risk
Dependency-only security patch with no application code changes; risk is limited to mermaid rendering behavior in Ask Sourcebot.

Overview
Bumps the resolved mermaid dependency from 11.16.0 to 11.16.1 in yarn.lock and records the upgrade in CHANGELOG.md. No package.json change—the existing ^11.16.0 range already allows the patched release.

This addresses several mermaid security issues (CSS injection, prototype pollution, and DoS in chart/diagram types) that affect Ask Sourcebot mermaid rendering in EE.

^{Reviewed by Cursor Bugbot for commit edb0927. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

@claude[bot] your pull request is missing a changelog!

[github-actions]

License Audit

❌ Audit failed to produce results. Check the workflow logs for details.