From ed7e0dd01e3b226bc7c0ce14bf27ef7ad9f78993 Mon Sep 17 00:00:00 2001 From: Frederic BIDON Date: Fri, 14 Aug 2026 22:36:37 +0200 Subject: [PATCH] doc(doc-site): fetch Mermaid locally the way CI does The note beside the vendored asset still named 11.16.0 and handed out a plain `curl -sL`, so the procedure a developer follows installed the version we had just moved off, unverified. It now carries the version, the flags and the digest the workflow uses, and says where that digest comes from. Co-Authored-By: Claude Opus 5 (1M context) Signed-off-by: Frederic BIDON --- .../codescan-static/js/mermaid11/README.txt | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/hack/doc-site/hugo/themes/codescan-static/js/mermaid11/README.txt b/hack/doc-site/hugo/themes/codescan-static/js/mermaid11/README.txt index 8cb34cb0..36d08964 100644 --- a/hack/doc-site/hugo/themes/codescan-static/js/mermaid11/README.txt +++ b/hack/doc-site/hugo/themes/codescan-static/js/mermaid11/README.txt @@ -1,4 +1,4 @@ -mermaid.min.js (Mermaid 11.16.0 UMD, dist/mermaid.min.js) is NOT committed. +mermaid.min.js (Mermaid 11.16.1 UMD, dist/mermaid.min.js) is NOT committed. Like the Relearn theme, it is fetched per-environment: - CI: the "Initialize theme and assets" step in .github/workflows/update-doc.yml @@ -9,5 +9,14 @@ needs Mermaid >= 11.16 — railroad diagrams are beta and newer than the theme's bundled Mermaid. Serving it as a local static asset keeps the rendered site free of runtime CDN calls. MIT License — https://github.com/mermaid-js/mermaid -Fetch it with: - curl -sL -o mermaid.min.js https://cdn.jsdelivr.net/npm/mermaid@11.16.0/dist/mermaid.min.js +Fetch it the way CI does — these bytes are published to the site and executed in +every visitor's browser, so they are checked rather than trusted: + + curl -fsSL --proto '=https' --tlsv1.2 -o mermaid.min.js \ + https://cdn.jsdelivr.net/npm/mermaid@11.16.1/dist/mermaid.min.js + echo "18327bef70d96fb505fe7287d9f6a7362ebf07ff6576ddfaffb1a06f3e1a2954 mermaid.min.js" \ + | sha256sum -c - + +The digest is the one pinned in update-doc.yml, and it is the file npm publishes: +`dist/mermaid.min.js` inside mermaid-11.16.1.tgz, whose own tarball hash matches the +integrity recorded in the registry. Moving the version means moving both.