Allow users to update scripts used as dependencies (Mermaid, PlantUML, KaTeX, ...)

[deining]

In #787, a community member requested the update to Mermaid 8.13.4. Script updates are quite frequent, and from a user's perspective, it might be cumbersome to have to wait for someone to update the script(s) in the sources. This made me think if can can do better here, and yes, I think we can:

Currently scripts are defined like

<script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.min.js"
integrity="sha512-JERecFUBbsm75UpkVheAuDOE8NdHjQBrPACfEQYPwvPG+fjgCpHAz1Jw2ci9EXmd3DdfiWth3O3CQvcfEg8gsA=="
crossorigin="anonymous">
</script>

Proposal for improvement:

My proposal is to extract these script calls from their container files (mainly layouts\partials\scripts.html) and to create individual partials for each script call. This way users can copy the script partials into their site folder layouts\partials, thus overriding the theme's script. Then users can easily define a new version inside their scripts.

One may argue that SRI generation is out of scope for most users. I tend to disagree, but hugo 0.90 comes to rescue here:
Hugo 0.90.0 introduced remote lookups in resources.Get. Therefore users can use this feature for automated generation of the SRI hash. That's all what they have to give inside their script (provided they are using Hugo 0.90.x):

{{ $katexjs := resources.GetRemote "https://cdn.jsdelivr.net/npm/[email protected]/dist/mermaid.min.js" }}
{{ $secureJS := $katexjs | resources.Fingerprint "sha512" }}
<script type="text/javascript" src="{{ $secureJS.Permalink }}" integrity="{{ $secureJS.Data.Integrity }}">
</script>

By specifying mermaid@latest, they can even fetch the latest version, freeing them from checking for new versions regularly:

{{ $katex-js := resources.GetRemote "https://cdn.jsdelivr.net/npm/mermaid@latest/dist/mermaid.min.js" }}

Users not on Hugo 0.90 yet still have to put in the SRI hash, but by making use of the Online SRI Hash Generator, this should be doable for everyone.

I'm willing to work on this improvement and provide documentation on the user guide if desired.

Thoughts?

[LisaFC]

That is very interesting - I hadn't realized Hugo 0.90.0 let you do that! I agree it would be great for users who wanted to update these scripts independently of theme updates.

Thoughts from anyone else about this approach?

[huima]

Has there been any work on this or would be possible to get a bump up to Mermaid Js again?

It seems that new versions include a lot useful new graph types:

https://github.com/mermaid-js/mermaid/releases/tag/v9.3.0