From 846c15e23630338357ed618b7505cd538114ff45 Mon Sep 17 00:00:00 2001
From: TsunamiNoAi <spam@falseblue.com>
Date: Fri, 7 Aug 2026 13:25:48 -0400
Subject: [PATCH] chore: bump pozeiden v0.2.0 -> v0.4.0

Picks up pozeiden's two 0.3.0 security fixes that the CLI/WASM mermaid
paths were missing (GHSA-p2c5-qmq5-3r4f SVG/XSS injection,
GHSA-rg4m-w3p2-gf3p out-of-bounds writes) plus the 0.4.0 hardening,
accessibility metadata, and layout rewrite. Behaviour change per
pozeiden's stability policy: emitted mermaid SVG bytes change (wider
default font stack; accTitle/accDescr become <title>/<desc>).

Verified: zig build test, zig build (CLI renders a mermaid pie through
pozeiden 0.4.0), zig build wasm; zon2json-lock regenerated (also picks
up pozeiden's corrected transitive mvzr ref pin).
---
 CHANGELOG.md            | 10 ++++++++++
 build.zig.zon           |  4 ++--
 build.zig.zon2json-lock |  8 ++++----
 3 files changed, 16 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 104e559..574d155 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,16 @@ same stability guarantee.
 
 ## [Unreleased]
 
+### Changed
+
+- Bumped the lazy `pozeiden` dependency v0.2.0 → v0.4.0, picking up its two
+  0.3.0 security fixes (GHSA-p2c5-qmq5-3r4f SVG/XSS injection,
+  GHSA-rg4m-w3p2-gf3p out-of-bounds writes) plus the 0.4.0 hardening and
+  layout work. **Behaviour change:** mermaid SVG emitted by the CLI/WASM
+  paths changes bytes — the default font stack now ends in
+  `Liberation Sans, DejaVu Sans, sans-serif`, and `accTitle:`/`accDescr:`
+  directives become SVG `<title>`/`<desc>` accessibility metadata.
+
 ## [0.11.0] — 2026-07-23
 
 ### Added
diff --git a/build.zig.zon b/build.zig.zon
index c12097a..0974cae 100644
--- a/build.zig.zon
+++ b/build.zig.zon
@@ -62,8 +62,8 @@
         // The CLI and WASM builds use it for mermaid rendering; falls back to
         // noop_mermaid.zig when pozeiden is unavailable.
         .pozeiden = .{
-            .url = "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.2.0.tar.gz",
-            .hash = "pozeiden-0.2.0-NAqiXaypCgBCkAMB3WZpGLPnwV5XTsUvOf3KUY9aAN0p",
+            .url = "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.0.tar.gz",
+            .hash = "pozeiden-0.4.0-NAqiXYMXCwCzyp6k5efqAnjQ9j_0CWeuyJcw62yfnWxK",
             .lazy = true,
         },
         .yaml = .{
diff --git a/build.zig.zon2json-lock b/build.zig.zon2json-lock
index 203c788..eef52e6 100644
--- a/build.zig.zon2json-lock
+++ b/build.zig.zon2json-lock
@@ -29,14 +29,14 @@
     "url": "git+https://github.com/github/cmark-gfm.git#587a12bb54d95ac37241377e6ddc93ea0e45439b",
     "hash": "sha256-egCWzw09e5daT8cnlSORC3gep9soiqonVC4GQ/s3voM="
   },
-  "pozeiden-0.2.0-NAqiXaypCgBCkAMB3WZpGLPnwV5XTsUvOf3KUY9aAN0p": {
+  "pozeiden-0.4.0-NAqiXYMXCwCzyp6k5efqAnjQ9j_0CWeuyJcw62yfnWxK": {
     "name": "pozeiden",
-    "url": "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.2.0.tar.gz",
-    "hash": "sha256-9j8xkNndJX+l20+/qlfK2aLFCfPQsX1xoTDQ+V2jXUg="
+    "url": "https://github.com/sc2in/pozeiden/archive/refs/tags/v0.4.0.tar.gz",
+    "hash": "sha256-uvGGJICGYLTqqDnOQcakvn3ft2MEcj5OmLP0puS4g/g="
   },
   "mvzr-0.3.9-ZSOky8FzAQBQ9-GkQnaLjOZZHxrioD8NwY-QyZT6oAyR": {
     "name": "mvzr",
-    "url": "git+https://github.com/mnemnion/mvzr?ref=v0.3.10#dd0e1bd2d6b10f9650317b30baef7ab7bc9dd9ec",
+    "url": "git+https://github.com/mnemnion/mvzr?ref=v0.3.9#dd0e1bd2d6b10f9650317b30baef7ab7bc9dd9ec",
     "hash": "sha256-hUGdJPjC1PAm6zWL9eAE7A+wAfzf6Q7uSutT2Xe7EMU="
   },
   "zig_yaml-0.3.2-C1161q3CAgCEpqWl_MKjkQpPZmos4DHBJewpb58XMcAL": {