Pin default KaTeX and markmap-autoloader versions - #2736
Merged
chalin merged 10 commits intoAug 24, 2026
Conversation
KaTeX build-time assets and the markmap-autoloader page script now load pinned versions from theme/hugo.yaml (params.katex.version, params.markmap.version) instead of resolving `latest` / unversioned CDN URLs. Same pattern as the Mermaid pin (google#2703): fail-closed errorf when the param is unset, suppressible warnidf on floating versions, and an exact-version canary test (mermaid-version.test.mjs generalized to script-version-pins.test.mjs, covering all three pins).
- User guide: KaTeX and MarkMap version sections, rendered live from the theme params, with the floating-version suppression IDs. - Maintainer notes: generalize the Mermaid-version section to all pinned script dependencies (anchor mermaid-version -> script-versions). - Changelog + 0.17.0 blog post: cover all three pins. - Renovate: extend the JSONata customManager to the katex and markmap params.
Keeps the pins' changelog coverage in the user-facing entry only, with the maintainer entry limited to the config-home move; updates the refcache and md-output golden for the new anchors and description.
- Canary: asserts $version is assigned exactly once and that every CDN URL line carries $version itself, closing the reassignment and printf-literal false-clean paths. - katex.html and scripts.html: skip the fetch/emit flow entirely when the version param is unset (Mermaid's if-version shape), instead of erroring and then still building CDN URLs. - Maintainer notes: keep the published #mermaid-version anchor.
- Strips Hugo template comments before matching, so an inert decoy comment can't satisfy the URL assertions. - Anchors the version read at both ends of the template action, closing the appended-pipeline-stage (same-line or multiline default) false-clean paths.
- Blog: resolve-from phrasing replaces float; #script-pins -> #script-dep-pins (inbound refs updated). - Changelog: one Other-changes entry covers all three pins. - Maintainer notes: drop the never-released mermaid-version legacy anchor; single params.PACKAGE.version placeholder replaces the double package/param enumeration.
… test - User guide: one 'Pinned script-dependency versions' section homes the rationale, override config (params.PACKAGE.version placeholder), and warning suppression; the three per-tool passages shrink to their current pin plus a link. Partials' warning URLs point at the shared section. - Factors the markmap block out of scripts.html into scripts/markmap.html, invoked like the mermaid/katex partials. - Canary test simplified to lint posture: full YAML exact-version assertions stay; the partial-side checks drop the anti-evasion machinery (comment stripping, both-ends anchoring, assignment counting), whose threat code review owns. The markmap line-scoping carve-out disappears with the factoring. - Maintainer notes: katex bumps check the KaTeX version Hugo's transform.ToMath docs pair with (embedded engine renders the markup the pinned assets style).
chalin
marked this pull request as ready for review
August 24, 2026 23:08
This was referenced Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
latest#2705markmap-autoloaderversion instead of loading it unversioned #2706theme/hugo.yaml(params.katex.version,params.markmap.version), mirroring the Mermaid pin (Mermaid: pin default version, droplatest#2704 + Mermaid: harden version pin (single home, floating-version warning, canary) #2711): fail-closederrorfwhen the param is unset (the fetch/emit flow is skipped entirely, Mermaid's shape), suppressiblewarnidfon floating versions, exact-version canary test, Renovate coverage.mermaid-version.test.mjsintoscript-version-pins.test.mjs, covering all three pins from one table. Adversarial review rounds hardened it beyond the Mermaid original: template comments are stripped, the version read is anchored as the whole template action,$versionmust be assigned exactly once, and every CDN-URL line must interpolate$versionitself.#script-versions, with#mermaid-versionkept as a legacy anchor); changelog and 0.17.0 blog post updated.