fix(#560): drop unused mermaid npm dep to end CDN version drift - #564
Conversation
antora/supplemental-ui/js/mermaid-init.js loads Mermaid from a hardcoded jsDelivr URL (mermaid@11.10.1), while antora/package.json declared mermaid ^11.10.1 as a runtime dependency. Nothing in the site code imports the npm package -- the Asciidoctor extension in antora/extensions/mermaid.js only wraps mermaid block macros in <div class="mermaid"> for the CDN-loaded runtime to render -- so npm bumps of mermaid never affected what visitors executed. The two version sources drifted independently, which triggered recurring dependency-bump PRs (e.g. #557, #530, #542, #543, #544) that were runtime no-ops and were closed unmerged. Option 3 from the issue: remove mermaid from antora/package.json and regenerate antora/package-lock.json so the npm dep no longer misleads reviewers, dependabot, renovate, and the fullsend review agent. Add a comment in mermaid-init.js noting that the CDN URL is now the sole source of truth for the runtime version, so future contributors do not reintroduce the drift. Closes #560
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
|
🤖 Finished Review · ✅ Success · Started 3:30 PM UTC · Completed 3:44 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $8.13 |
|
🚀 Preview is available at https://dc1a96f8.enterprise-contract.pages.dev |
|
Risk Assessment: moderate (2/5) DetailsDocs-site cleanup removing an unused npm dependency; large diff is almost entirely lockfile noise, the functional change in mermaid-init.js is small, files are cold with no recent collisions, and the PR cleanly implements the linked issue chosen option. |
|
Looks good to me |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
fullsend-ai-review
Bot
added
the
ready-for-merge
|
🤖 Finished Retro · ✅ Success · Started 1:42 PM UTC · Completed 1:50 PM UTC Commit: Runtime: claude · Model: opus → claude-opus-4-7 · Effort: high · Cost: $2.08 |
Retro for PR #564Workflow outcome: clean pipeline. Triage → code → review → two human approvals → merge, ~4 days, one commit, zero rework. Agent review verdict ( No proposals filed — every improvement this retro could raise is already tracked upstream. Evidence collected below is for those existing issues; per retro-analysis guidance, evidence-for issues are not filed as new proposals. Evidence for existing open issues
Positive signalTriage on #560 correctly flagged that the retro-agent-filed issue text referenced "Dependabot" while the repo uses Renovate; the code agent used the right tool anyway. Human reviewers added no inline comments and the two approvals came within minutes of each other — an autonomy-readiness data point in favor of the lightweight-review-path proposals cited above (issue-body wording drift is worth watching if it recurs, but a single instance is not a pattern). Agents repo discovered from run logs: |
2 participants
Summary
Removes the unused
mermaidruntime dependency fromantora/package.jsonso that npm version bumps (dependabot / renovate) no longer misleadingly appear to update the mermaid runtime.Why
antora/supplemental-ui/js/mermaid-init.jsloads Mermaid from a hardcoded jsDelivr URL:Meanwhile
antora/package.jsondeclared"mermaid": "^11.10.1"underdependencies, and nothing in the repo's JavaScript actually imports it — the Asciidoctor extension inantora/extensions/mermaid.jsonly wrapsmermaidblock macros in a<div class="mermaid">for the CDN-loaded runtime to render. That meant npm bumps of mermaid were runtime no-ops (see the recently closed-unmerged PRs #557, #530, #542, #543, #544).Change (option 3 from the issue)
mermaidfromantora/package.jsondependencies.antora/package-lock.json(removes ~1400 transitive lockfile lines that were never shipped or executed).antora/supplemental-ui/js/mermaid-init.jsdocumenting that the CDN URL is the sole source of truth for the runtime mermaid version, so future contributors don't reintroduce the drift.Option 3 was chosen because the npm install truly was unused at runtime — no code path required it — so removing it is the smallest correct change and aligns with the repo's "Simplicity first" / "Surgical changes" guidance in
AGENTS.md. Options 1 (bundle from npm via an Antora build extension) and 2 (template the version frompackage.jsoninto the supplemental JS) would each add moving parts to keep two version sources in sync; option 3 collapses to one source.Notes on renovate / dependabot ignore rules
The issue's option 3 mentions
.github/dependabot.yml, but this repo usesrenovate.json(which extendsgithub>conforma/.github//config/renovate/renovate.json). Oncemermaidis no longer declared as an npm dependency, Renovate's npm manager has nothing to look at, so no explicit ignore rule is needed to stop the noise. If a future Renovate regex manager is added that also parses the CDN URL, an ignore rule can be added at that point.Testing
npm ci --dry-runinantora/succeeds, confirmingpackage.jsonandpackage-lock.jsonare consistent after the removal.node --check antora/supplemental-ui/js/mermaid-init.jspasses.require('mermaid')/from 'mermaid'anywhere in the repo, so nothing depended on the removed package.Closes #560
Post-script verification
agent/560-mermaid-cdn-drift)e88d36d43b7eba170addb0520e776a42b263eb66..HEAD)