fix(parser): pin langium to 4.2.1 to keep chevrotain v11 and Node 20 support

[ashishjain0512]

Resolves #8027

The problem

langium 4.2.2+ switched from chevrotain v11 to chevrotain v12, which:

• declares engines: { node: ">=22.0.0" }
• calls Object.groupBy — a Node 21+ API — in lib/src/parse/grammar/checks.js during grammar validation

Since #7907 chevrotain is bundled into the published @mermaid-js/parser, so after the renovate patch-bump of langium ^4.0.3 → ^4.2.4 (#7916 era), the published parser bundle contained Node 22-only code. Consumers running mermaid on Node 20 could hit TypeError: Object.groupBy is not a function, and langium generate crashed for contributors on Node 20 with the same error.

The langium/chevrotain version map:

langium	chevrotain	Node support
≤ 4.2.1	~11.1.1	no engines restriction
≥ 4.2.2	~12.0.0	>=22.0.0, uses Object.groupBy

The fix

• Pin langium to 4.2.1 (the last release on chevrotain v11) in packages/parser, and via a pnpm override — the override is required because langium-cli's own dependency range (~4.2.0) would otherwise still resolve its internal langium to 4.2.4 → chevrotain 12, keeping langium generate broken on Node 20
• Pin langium-cli to ~4.2.1 (4.3.0 tracks langium 4.3 / chevrotain 12)
• Add a renovate packageRules entry disabling updates for langium, langium-cli, chevrotain, and @chevrotain/types, with a description documenting when to lift the pin — this drift was originally introduced by an automated renovate bump, so without this rule the pin would be silently re-broken on the next patch sweep
• This also collapses the dependency tree back to a single chevrotain version (11.1.2); previously chevrotain 11 (parser pins) and 12 (via langium) were both resolved

Trade-off

Staying on chevrotain v11 keeps its pinned lodash-es@4.17.23 (the CVE-flagged version that motivated bundling in #7907). Exposure is limited since it's bundled rather than a published dependency, but lockfile scanners may still flag it. To be revisited when Node 20 support is dropped — the renovate rule description marks the spot.

Verification (all on Node 20.12.0)

• ✅ pnpm install + full pnpm build (previously failed in prepare)
• ✅ pnpm --filter parser langium:generate (previously: TypeError: Object.groupBy is not a function)
• ✅ Parser unit tests: 691/691
• ✅ tsc --emitDeclarationOnly on the parser package
• ✅ Built mermaid-parser.core.mjs imports and parses a pie diagram on Node 20; grep Object.groupBy across all dist chunks: zero hits
• ✅ renovate-config-validator passes (same command as the config-lint workflow)
• ✅ api-extractor rollup (prepack) — run on Node 22, as scripts/prepack.ts itself requires --experimental-strip-types (publish-time-only path)

🤖 Generated with Claude Code

Summary

• Pin langium and langium-cli to 4.2.1 for Chevrotain 11 and Node 20 compatibility.
• Add a pnpm override to prevent newer Langium versions from resolving.
• Disable Renovate updates for Langium, Langium CLI, Chevrotain, and @chevrotain/types.
• Add a patch changeset for @mermaid-js/parser.
• Verify installation, build, Langium generation, parser tests, declaration generation, bundled parser behavior, distribution contents, and Renovate configuration.

[changeset-bot]

🦋 Changeset detected

Latest commit: 639938b

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@mermaid-js/parser	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[netlify]

✅ Deploy Preview for mermaid-js ready!

Name	Link
🔨 Latest commit	639938b
🔍 Latest deploy log	https://app.netlify.com/projects/mermaid-js/deploys/6a7330e6b6d491e5084fd6d6
😎 Deploy Preview	https://deploy-preview-8028--mermaid-js.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e425ac50-43c9-4b70-a28a-bba82d7fa7f5

📥 Commits

Reviewing files that changed from the base of the PR and between f0f96c0 and 639938b.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (4)

• .changeset/pin-langium-chevrotain-11-node20.md
• package.json
• packages/parser/package.json
• renovate.json

---

📝 Walkthrough

Walkthrough

The pull request pins Langium and Langium CLI to version 4.2.1, adds a pnpm override, disables Renovate updates for related packages, and adds patch-release metadata for @mermaid-js/parser.

Changes

Langium version pinning

Layer / File(s)	Summary
Langium dependency and update constraints package.json, packages/parser/package.json, renovate.json, .changeset/pin-langium-chevrotain-11-node20.md	The project pins Langium and Langium CLI to 4.2.1, disables automated updates for related packages, and records the change in a patch changeset.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: sidharthv96

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the primary change: pinning Langium to preserve Chevrotain v11 and Node 20 support.
Description check	✅ Passed	The description explains the problem, implementation, trade-offs, issue link, and verification, but omits the template headings and task checkboxes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bug/8027_pin-langium-chevrotain-node20

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

Open in StackBlitz

@mermaid-js/examples

npm i https://pkg.pr.new/@mermaid-js/examples@8028

mermaid

npm i https://pkg.pr.new/mermaid@8028

@mermaid-js/layout-elk

npm i https://pkg.pr.new/@mermaid-js/layout-elk@8028

@mermaid-js/layout-tidy-tree

npm i https://pkg.pr.new/@mermaid-js/layout-tidy-tree@8028

@mermaid-js/mermaid-zenuml

npm i https://pkg.pr.new/@mermaid-js/mermaid-zenuml@8028

@mermaid-js/parser

npm i https://pkg.pr.new/@mermaid-js/parser@8028

@mermaid-js/tiny

npm i https://pkg.pr.new/@mermaid-js/tiny@8028

commit: 639938b

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.60%. Comparing base (f0f96c0) to head (639938b).
⚠️ Report is 18 commits behind head on develop.

Additional details and impacted files

@@             Coverage Diff             @@
##           develop    #8028      +/-   ##
===========================================
- Coverage    77.66%   77.60%   -0.06%     
===========================================
  Files          567      567              
  Lines        74906    74906              
  Branches     12657    12657              
===========================================
- Hits         58172    58132      -40     
- Misses       15739    15779      +40     
  Partials       995      995              

Flag	Coverage Δ
e2e	70.61% <ø> (-0.08%)	⬇️
unit	74.99% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 4 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[aloisklink]

LGTM! My only comment is that the .changeset is very very verbose and will use up too much space in the CHANGELOG.md/release notes.

If a user does want to see more details, there will be a link to this PR so that they can read more about this.

[argos-ci]

The latest updates on your projects. Learn more about Argos notifications ↗︎

Build	Status	Details	Updated (UTC)
default (Inspect)	✅ No changes detected	-	Aug 5, 2026, 11:05 AM