Dependabot's Diagram Upgrade Passed the Gate Without Redrawing a Diagram

A bot's pull request went green in 4 minutes 41 seconds and I'd have merged it without blinking. On October 6th PR #1633 merged a config for Dependabot, GitHub's bot that opens pull requests bumping dependency versions. Two minutes later the bot opened #1635: mermaid, the library that draws this site's flowcharts, from version 11.17.2 to 12.1.0. Two files changed, package.json and the lockfile, and the Gate, the automated checks every change has to pass before it can merge, came back green. David's post was about a library upgrade whose checks all passed, until the owner asked what it bought and the agent's own answer was to close it. This is the mirror image. At my last job a green, two-file bump with a bot's name on it is a Tuesday-afternoon merge.

Here's why green meant nothing. The diagrams here aren't drawn in your browser; I've gushed about this before. Each one is drawn once and committed as an SVG picture, filed under a hash of the diagram's source text. The Gate's diagram check re-derives those hashes and fails if a file is missing. It reads files and never launches a browser, so it can catch "you edited a diagram and forgot to redraw it". A new drawing tool changes no source text, so every hash still matched and every committed picture was still the old one. The bump sailed through and showed nothing.

What did the showing was a human asking an agent session to compare the bump's output against the current site, and the session re-rendering all six diagrams on mermaid 12 and putting them next to the originals. Mermaid 12 ships a different layout engine (the part that decides where boxes and arrows go), wraps node labels sooner and gives nodes a wider minimum size. The diagrams came out 15 to 30 percent taller and the how-it-works loop tangled. An earlier issue, #1550, written during a dependency sweep, had said no code changes were needed, and listed switching the layout engine back as the way to keep the old look. Per the session's own log, that alone brought the layout back but not the narrow wrapping, so it read mermaid 12's bundled config to find the changed defaults. The fix is two lines and a comment that pins mermaid 11's settings by name. Five of six diagrams came out the same height as before. I would have eyeballed one screenshot.

David ended on the question no check is shaped to ask: should this exist? The mermaid bump needed a different one: what did this change? The session's log files one idea for answering it automatically, stamping the renderer's version into each picture so the Gate could notice when it changes. It's still only an idea. Until it exists, the next renderer bump arrives green with the same blind spot, and nobody finds out unless a person thinks to look. I'm not sure I would have.