MD.Scribe 3.5.0 — Loom

Mermaid 12 comes to the docs, and a repair that finally reaches the page.

Highlights

Mermaid 11.17.2 → 12.3.0. Authors get the 12 features in a plain fenced block:

• edge IDs with animation — A e1@--> B, then e1@{ animate: true } or e1@{ animation: fast };
• step-by-step flow animation (12.3+) — e1@{ step: 1 }, plus flowchart.stepDuration and flowchart.stepNumbers;
• the circle and cross edge markers — A ---o B, A ---x B;
• the @{ shape: … } family — manual-file, cylinder, document, paper-tape and the rest.

The 12 defaults are deliberately not adopted: Mermaid 12 draws flowcharts with the redux-color
theme, the neo look and an ELK layout, which would restyle every existing diagram without anyone
asking. look: 'classic' and layout: 'dagre' are pinned instead. Measured against 11.17.2 on the
same document: a sequence diagram keeps its geometry exactly (-50 -10 514 451 on both), a flowchart
is laid out with 12's wider spacing (0 0 624.66 140 → 0 0 837.88 140, same height, still scaled
by useMaxWidth). Dropping those two keys adopts the new defaults.

The vendored bundle grows from 3.5 MB to 5.5 MB raw (0.98 → 1.58 MB gzip) and is still injected only
on pages that contain a diagram.

Fixed

• A repaired diagram was parsed unrepaired. The server writes the repaired source into the
  <pre> body and the author's text into data-mermaid-source for the copy control, but the loader
  read the attribute — so every auto-repair was discarded: the badge announced a repair and Mermaid
  rejected the original. Reproduced on 11.17.2 as well, so the defect predates this release. A node
  label with unquoted parentheses now renders with its repair applied, and a test pins the DOM
  contract the client relies on.
• The vendor rebuild dropped the icon fallback. node build.mjs --vendor and
  node generate-icons.mjs both write src/View/Icons.php, but only the second added the
  circle-alert entry Icons::svg() falls back to. The class raised Undefined array key and drew
  an empty <svg> for any name outside icons.json. Both generators now apply the same rule;
  tests/Unit/IconsTest.php fails if the fallback goes missing.

Changed

• league/commonmark 2.10.3 → 2.10.7, KaTeX 0.16.47 → 0.19.1, lucide 0.469 → 0.577, tailwind 4.3.5,
  esbuild 0.28.2, actions/checkout@v7, actions/setup-node@v7.
• Dependabot runs monthly with a two-pull-request cap per ecosystem, and the two majors that still
  need a deliberate decision (lucide 1.x, phpunit 13.x) are ignored by version — not by update type,
  because ignore also silences security updates.
• docs/development.md states what is vendored: which packages are installed at release time, which
  files travel inside the archive, and that the updater's release check is the only outbound request.

Verification of this release

• vendor/bin/phpunit --no-coverage → OK (218 tests, 688 assertions, 1 skipped)
• phpstan analyse level 6 → no errors; Invoke-ProjectDoctrine.ps1 → 12 checks, 0 errors, 0 warnings
• the archive was verified against its own manifest: 979 entries, 979 matching sha256, nothing missing
• the extracted archive was served and exercised: /, ?page=browser, ?page=themes,
  ?api=search&q=markdown, ?file=nope.md → 404, ?api=manifest → application/manifest+json,
  and the page reports version 3.5.0

Install

unzip MD.Scribe-3.5.0.zip -d /var/www/docs
cd /var/www/docs && cp .md.ini.example .md.ini   # or let the first request create it

Point the docroot at public/. The archive ships vendor/, so no Composer on the host; PHP 8.5 is
the floor and CI runs 8.5 only.