Skip to content

Rebuild the vendored highlight.js bundle at 11.12.0 - #31

Merged
max-sixty merged 1 commit into
mainfrom
chore/vendor-highlight-11.12.0
Aug 24, 2026
Merged

Rebuild the vendored highlight.js bundle at 11.12.0#31
max-sixty merged 1 commit into
mainfrom
chore/vendor-highlight-11.12.0

Conversation

@leaf-agent

@leaf-agent leaf-agent commented Aug 23, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

Weekly vendored-bundle sweep. scripts/vendor-highlight.sh held HLJS_VERSION=11.11.1 while upstream is at 11.12.0 — the pin is a shell variable rather than a manifest entry, so dependabot cannot see it and the drift is silent until this step reads it. Bumped the variable and reran the script; the rebuilt bundle is the change, not the version string.

The bundle is a function of both the pin and the registry, since the script reads $languages.names out of registry.json to decide what to bundle. All fifteen declared names still register under leaf's own spelling, with html and toml resolving through the xml and ini aliases — so the page's vocabulary and the tokenizer's remain unable to disagree.

11.12.0 is grammar work, no API change. Among the languages leaf carries: a ReDoS fix in xml removing recursive sublanguage references, a markdown fix that stops a *** thematic break reading as the start of bold text, rust char-literal escapes no longer leaking their highlight past the literal, and keyword or literal additions to css, go, java, javascript, python, and shell.

Verification

hljs.listLanguages() against the new bundle returns exactly the registry's fifteen names, none missing and none extra, and hljs.versionString reports 11.12.0.

Tokenizing round-trips the source words for each of the sampled languages — the UNREAD_SYNTAX contract, checked properly across the corpus by the browser gate below.

Full suite green on this branch — uv run pytest tests --run-nightly gave 1011 passed, 6 skipped in 615.23s. The targeted readings, run first:

tests/test_interact.py -k "language or languages or diff_resolves"   6 passed
tests/test_render.py -k "every_language_returns_the_source
                         or code_is_colored_without_a_word_moving
                         or reader_cannot_tell_from_its_block"       3 passed

test_every_path_a_diff_resolves_names_a_language_the_bundle_carries and test_every_language_returns_the_source_it_was_given are the two that would catch a bundle built from a different list than the registry states.

@leaf-agent
Rebuild the vendored highlight.js bundle at 11.12.0
6e8367d 
The pin lives in scripts/vendor-highlight.sh as a shell variable, so
dependabot cannot see it; the weekly sweep is what catches the drift.
The bundle is a function of the pin and the registry's $languages.names,
and rerunning the script is how those two stay unable to disagree: all
fifteen declared names still register under leaf's own spelling, html
and toml through the xml and ini aliases.

11.12.0 is grammar work. Among the languages leaf carries: a ReDoS fix
in xml removing recursive sublanguage references, a markdown fix that
stops a `***` thematic break reading as the start of bold, rust char
escapes no longer leaking their highlight, and additions to css, go,
java, javascript, python, and shell.
leaf-agent
leaf-agent commented Aug 23, 2026
View reviewed changes

@leaf-agent leaf-agent left a comment

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the bump; nothing to change in the diff. Rebuilding from scripts/vendor-highlight.sh at HLJS_VERSION=11.12.0 reproduces the committed bundle byte-for-byte, so the artifact is a function of the pin and the registry as the script's header claims, not a hand-edited blob.

One observation, not about this diff: the weekly step names two bundles, and only one moved here. scripts/vendor-marked.sh still holds MARKED_VERSION=18.0.7 while upstream is at 18.0.10 — 18.0.8 published 2026-08-04 and 18.0.10 on 2026-08-18, so both predate this sweep. Nothing else on the branch or in the open PRs covers it, and dependabot can't see that pin either, so it stays invisible until the next weekly reading. Separate concern, separate PR — noting it here because this is where the sweep's other half would have been.

What I checked
  • Reproducible: reran scripts/vendor-highlight.sh on the merged tree; cmp against the committed highlight.esm.js is identical (77602 bytes). versionString in the bundle reads 11.12.0, and npm view highlight.js dist-tags confirms that is latest.
  • The two lists still agree: the bundle's registerLanguage calls are exactly the fifteen names in registry.json's $languages.names — none missing, none extra — with html/toml arriving through the xml/ini aliases.
  • Round trip: drove both bundles over the fifteen languages × nine samples, including the cases 11.12.0's grammar work touches (a markdown *** thematic break, a rust 'a\n' char literal, <script>/<style> nested in html — the ReDoS fix that removed xml's recursive sublanguage references). Zero round-trip failures against the new bundle, so the syntax partition promise and UNREAD_SYNTAX hold.
  • No role silently lost: compared the hljs-* scope set each language emits, old against new. Nothing dropped — which is the failure SYNTAX_ROLE's fall-back-to-plain design would have absorbed without an error. The one change is diff hunk headers now emitting hljs-meta (@@ -1 +1 @@ was bare before), which maps to the existing fn role, so it colours rather than reading wrong.
  • No other consumer: 11.11.1 appeared only in the script and the bundle; nothing pins a size, hash, or version elsewhere. The hljs surface leaf.js uses — getLanguage, highlight, the hljs- class prefix — is unchanged in 11.12.0.
  • CI: every gating check on 6e8367d settled green.

@leaf-agent

leaf-agent commented Aug 23, 2026

Copy link
Copy Markdown
Collaborator Author

The review asks for no change to this diff, and the sweep's other half is already covered: #32 rebuilds marked at 18.0.10 and touches only scripts/vendor-marked.sh and the vendored marked.esm.js. It opened at 09:50, six minutes before the review, so the "nothing in the open PRs covers it" reading was stale rather than wrong about the drift — the pin really was at 18.0.7. Both halves of the weekly sweep are therefore proposed, one PR each.

Nothing further to do here. Every gating check on 6e8367d is green.

State of the other half

#32's test check went red at 10:01 on a single failure, test_an_open_tab_reloads_before_posting_through_a_revendored_layer, timing out waiting for a poll response with the counters unmoved (sends=1 acked=1 pending=0 asked=2 heard=2 at both the start and the end of the wait). That test exercises layer revendoring, not thread Markdown, so it is not downstream of the marked bundle; the isolated timeout matches the contention shape rather than a regression. tend-review is still in progress there, and that PR's own run owns its CI — I have not touched it.

@leaf-agent leaf-agent mentioned this pull request Aug 24, 2026
Closed
@max-sixty
max-sixty merged commit 7fc50b1 into main Aug 24, 2026
7 checks passed
@max-sixty
max-sixty deleted the chore/vendor-highlight-11.12.0 branch August 24, 2026 19:24
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@leaf-agent @max-sixty