diff --git a/bpmn/package-lock.json b/bpmn/package-lock.json
index b2ad5a10e..dc6af7d25 100644
--- a/bpmn/package-lock.json
+++ b/bpmn/package-lock.json
@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "license": "MIT",
       "dependencies": {
-        "bpmn-js": "18.0.0",
+        "bpmn-js": "18.1.1",
         "micro": "10.0.1",
         "pino": "9.5.0",
         "pino-debug": "^2.0.0",
@@ -613,12 +613,12 @@
       }
     },
     "node_modules/bpmn-js": {
-      "version": "18.0.0",
-      "resolved": "https://registry.npmjs.org/bpmn-js/-/bpmn-js-18.0.0.tgz",
-      "integrity": "sha512-eZR4hqk2BT0m9jAGGtp/f1TD0m7LXXKfYle99q75d+NjSmxetIuvxGn48S9W+H8arJ7vgsls2GELzXoDuEE0eg==",
+      "version": "18.1.1",
+      "resolved": "https://registry.npmjs.org/bpmn-js/-/bpmn-js-18.1.1.tgz",
+      "integrity": "sha512-7LN+f7y1u4FtbI/6lI3Elf2phEBa0RVr0YJZrSG46RyiHU9wY5NR2n9OIqKeuGJq1RJ/YMowMoUNDIBdmb9zbg==",
       "dependencies": {
         "bpmn-moddle": "^9.0.1",
-        "diagram-js": "^15.1.0",
+        "diagram-js": "^15.2.3",
         "diagram-js-direct-editing": "^3.2.0",
         "ids": "^1.0.5",
         "inherits-browser": "^0.1.0",
@@ -1023,9 +1023,9 @@
       "license": "BSD-3-Clause"
     },
     "node_modules/diagram-js": {
-      "version": "15.1.0",
-      "resolved": "https://registry.npmjs.org/diagram-js/-/diagram-js-15.1.0.tgz",
-      "integrity": "sha512-Lrixuc4as/PGrkhf23k8yss+rLhyH2Zrln/CJxex0nOfC2P0ODb5lsDY0+MdDgjP2ADFFINqUXAGFcSSL8tw4g==",
+      "version": "15.2.3",
+      "resolved": "https://registry.npmjs.org/diagram-js/-/diagram-js-15.2.3.tgz",
+      "integrity": "sha512-C7MM5D7D0x6F5KsPzGmIPL/O9VoglTFSGrDnQNiFIA0SldC6WCwx/0nG9nS4Pwjtf7QeccaozF7FD1NAMHFs5Q==",
       "dependencies": {
         "@bpmn-io/diagram-js-ui": "^0.2.3",
         "clsx": "^2.1.0",
diff --git a/bpmn/package.json b/bpmn/package.json
index 621b9fec8..ee0543560 100644
--- a/bpmn/package.json
+++ b/bpmn/package.json
@@ -19,7 +19,7 @@
     "url": "https://github.com/yuzutech/kroki.git"
   },
   "dependencies": {
-    "bpmn-js": "18.0.0",
+    "bpmn-js": "18.1.1",
     "micro": "10.0.1",
     "pino": "9.5.0",
     "pino-debug": "^2.0.0",
diff --git a/mermaid/package-lock.json b/mermaid/package-lock.json
index 8bde96e1b..139279c2c 100644
--- a/mermaid/package-lock.json
+++ b/mermaid/package-lock.json
@@ -19,7 +19,7 @@
         "mermaid-server": "src/index.js"
       },
       "devDependencies": {
-        "mermaid": "11.4.0",
+        "mermaid": "11.4.1",
         "pngjs": "7.0.0",
         "standard": "17.1.2"
       }
@@ -763,15 +763,6 @@
         "@types/d3-selection": "*"
       }
     },
-    "node_modules/@types/dompurify": {
-      "version": "3.0.5",
-      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-3.0.5.tgz",
-      "integrity": "sha512-1Wg0g3BtQF7sSb27fJQAKck1HECM6zV1EB66j8JH9i3LCjYabJa0FSdiSgsD5K/RbrsR0SiraKacLB+T8ZVYAg==",
-      "dev": true,
-      "dependencies": {
-        "@types/trusted-types": "*"
-      }
-    },
     "node_modules/@types/geojson": {
       "version": "7946.0.14",
       "resolved": "https://registry.npmjs.org/@types/geojson/-/geojson-7946.0.14.tgz",
@@ -798,7 +789,8 @@
       "version": "2.0.7",
       "resolved": "https://registry.npmjs.org/@types/trusted-types/-/trusted-types-2.0.7.tgz",
       "integrity": "sha512-ScaPdn1dQczgbl0QFTeTOmVHFULt394XJgOQNoyVhZ6r2vLnMLJfBPd53SB52T/3G36VI1/g2MZaX0cwDuXsfw==",
-      "dev": true
+      "dev": true,
+      "optional": true
     },
     "node_modules/@types/yauzl": {
       "version": "2.10.3",
@@ -2124,11 +2116,13 @@
       }
     },
     "node_modules/dompurify": {
-      "version": "3.1.6",
-      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.1.6.tgz",
-      "integrity": "sha512-cTOAhc36AalkjtBpfG6O8JimdTMWNXjiePT2xQH/ppBGi/4uIpmj8eKyIkMJErXWARyINV/sB38yf8JCLF5pbQ==",
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/dompurify/-/dompurify-3.2.1.tgz",
+      "integrity": "sha512-NBHEsc0/kzRYQd+AY6HR6B/IgsqzBABrqJbpCDQII/OK6h7B7LXzweZTDsqSW2LkTRpoxf18YUP+YjGySk6B3w==",
       "dev": true,
-      "license": "(MPL-2.0 OR Apache-2.0)"
+      "optionalDependencies": {
+        "@types/trusted-types": "^2.0.7"
+      }
     },
     "node_modules/emoji-regex": {
       "version": "8.0.0",
@@ -4336,16 +4330,15 @@
       }
     },
     "node_modules/mermaid": {
-      "version": "11.4.0",
-      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.4.0.tgz",
-      "integrity": "sha512-mxCfEYvADJqOiHfGpJXLs4/fAjHz448rH0pfY5fAoxiz70rQiDSzUUy4dNET2T08i46IVpjohPd6WWbzmRHiPA==",
+      "version": "11.4.1",
+      "resolved": "https://registry.npmjs.org/mermaid/-/mermaid-11.4.1.tgz",
+      "integrity": "sha512-Mb01JT/x6CKDWaxigwfZYuYmDZ6xtrNwNlidKZwkSrDaY9n90tdrJTV5Umk+wP1fZscGptmKFXHsXMDEVZ+Q6A==",
       "dev": true,
       "dependencies": {
         "@braintree/sanitize-url": "^7.0.1",
         "@iconify/utils": "^2.1.32",
         "@mermaid-js/parser": "^0.3.0",
         "@types/d3": "^7.4.3",
-        "@types/dompurify": "^3.0.5",
         "cytoscape": "^3.29.2",
         "cytoscape-cose-bilkent": "^4.1.0",
         "cytoscape-fcose": "^2.2.0",
@@ -4353,7 +4346,7 @@
         "d3-sankey": "^0.12.3",
         "dagre-d3-es": "7.0.11",
         "dayjs": "^1.11.10",
-        "dompurify": "^3.0.11 <3.1.7",
+        "dompurify": "^3.2.1",
         "katex": "^0.16.9",
         "khroma": "^2.1.0",
         "lodash-es": "^4.17.21",
diff --git a/mermaid/package.json b/mermaid/package.json
index 79f4ef334..907a8111f 100644
--- a/mermaid/package.json
+++ b/mermaid/package.json
@@ -26,7 +26,7 @@
     "puppeteer": "23.6.0"
   },
   "devDependencies": {
-    "mermaid": "11.4.0",
+    "mermaid": "11.4.1",
     "pngjs": "7.0.0",
     "standard": "17.1.2"
   },