Zero known vulnerabilities and up to 71% less JavaScript

DiagramaHub 0.7.1 clears every known frontend vulnerability, runs the backend as non-root, caps request sizes, makes autosave reliable and lightens the load.

Some releases stand out for a new feature; others stand out because everything just works better. 0.7.1 is the second kind: we focused on security, on never losing an edit, and on making the app download far less JavaScript. There are no new screens, but if you self-host DiagramaHub or use it every day, here's what changed.

Zero known vulnerabilities in the frontend

The frontend's production dependencies had 25 security advisories, one of them high severity. They're now at zero. We upgraded DOMPurify to 3.4.16 (the library that sanitizes your diagram SVGs), Mermaid to 11.17.2 and react-router to 7.18.4.

We also found something uncomfortable: since the move to pnpm in 0.6.0, the 6 security overrides we force on dependencies were written in npm's format, and pnpm silently ignored them. They now live in pnpm.overrides and apply again.

A non-root backend and capped requests

Two changes for anyone running their own instance:

The backend container runs as an unprivileged user (app, uid/gid 1000), and the image uses Poetry 2.5.1 (1.8.3 and its dulwich dependency had security advisories).
A global request size limit: requests with a body larger than MAX_REQUEST_BODY_BYTES (5 MB by default) get a 413, whether the client declares the size or streams the body in chunks.

To upgrade, rebuild the image with docker compose up -d --build. In the development scenario (deploy/local-full), if your Linux user isn't uid 1000, Python won't be able to write its caches to the mounted folder; that's harmless, and the production image isn't affected. If you install dependencies outside Docker, use Poetry 2.

Autosave you can rely on

Two problems weren't obvious at first glance:

Opening a diagram marked it as modified. The autosave and the zoom/position save fired on load, changing the modification date and reshuffling "Recent". Now it only saves on a real change; panning, zooming or resizing a panel no longer counts as a modification.
Edits could be lost if you made them right before switching diagrams or leaving the editor, within autosave's 1.5-second wait.

flowchart LR
    A[You edit a diagram] --> B{What happens next?}
    B -->|You wait| C[Autosave]
    B -->|You switch diagrams| D[Saved on switch]
    B -->|You leave or hide the tab| E[Saved on leave]
    B -->|You close with pending changes| F[The browser warns you]

Saves are also sent one at a time, so a slow one can't overwrite a newer edit. And the top bar title no longer shows the previous diagram while the next one loads.

Up to 71% less JavaScript

The whole app used to ship as a single file. Now each page is downloaded on its own:

Login and the dashboard download 193 KB of JavaScript instead of 668 KB, and show up in ~105 ms and ~130 ms (previously ~165 ms and ~190 ms).
The editor paints the diagram in ~180 ms (previously ~300 ms).
The editor is preloaded in the background once you're signed in, so going from the dashboard to a diagram doesn't wait on a download.
Export loads its libraries only when you export, which keeps the editor lighter.

On the server, the dashboard's "Recent" list now comes from a single indexed query instead of reading every diagram of every project along with its content. The new MongoDB index is created automatically when the backend starts.

Small things that matter

Native browser alerts in AI generation and provider settings were replaced with in-app notices you can dismiss and that follow dark mode. Dates follow the interface language everywhere (PDF/PNG exports, billing, profile, editor), and more strings that were stuck in Spanish are now translated into English.

Upgrade

It's already live on DiagramaHub Cloud. If you self-host, grab the release from the repository and check the upgrade notes in the changelog.