Describe the bug
The mermaid diagrams on the published documentation site do not render. They appear as raw diagram
source instead of a picture, for example on
https://datafusion.apache.org/comet/contributor-guide/memory_management.html.
This is not specific to that page. Every page carrying a ```mermaid fence is affected, including
https://datafusion.apache.org/comet/contributor-guide/ci.html.
Steps to reproduce
Open either page above in a browser and look at the diagrams, or check the browser console for the
Content-Security-Policy violation.
Expected behavior
The diagrams render as diagrams.
Additional context
The cause is not the diagram sources and not the Sphinx configuration. Both diagram sources parse
cleanly under mermaid 11.12.1, and the pinned CDN module returns HTTP 200.
sphinxcontrib-mermaid defaults to mermaid_output_format = 'raw', which draws the diagrams in the
reader's browser and emits:
import mermaid from "https://cdn.jsdelivr.net/npm/mermaid@11.12.1/dist/mermaid.esm.min.mjs";
The ASF serves *.apache.org with a Content-Security-Policy whose script-src allows only
'self', data:, blob: and a handful of apache.org / apachecon / scarf.sh hosts:
script-src 'self' data: blob: 'unsafe-inline' 'unsafe-eval' https://www.apachecon.com/
https://www.communityovercode.org/ https://*.apache.org/ https://apache.org/ https://*.scarf.sh/
cdn.jsdelivr.net is not on that list, so the browser blocks the import, mermaid.js never loads, and
the <pre class="mermaid"> blocks are left as text. The same header is served on
airflow.apache.org and arrow.apache.org, so this is ASF infrastructure rather than anything
configured in this repository, and .asf.yaml has no knob for it.
apache/arrow hits the same wall and works around it with mermaid_output_format = 'svg', which
pre-renders the diagrams with mermaid-cli at build time and embeds them as
<object data="../_images/mermaid-<hash>.svg" type="image/svg+xml">. That is served from 'self'
and needs no script, so the CSP does not apply. Their published pages render correctly.
Describe the bug
The mermaid diagrams on the published documentation site do not render. They appear as raw diagram
source instead of a picture, for example on
https://datafusion.apache.org/comet/contributor-guide/memory_management.html.
This is not specific to that page. Every page carrying a
```mermaidfence is affected, includinghttps://datafusion.apache.org/comet/contributor-guide/ci.html.
Steps to reproduce
Open either page above in a browser and look at the diagrams, or check the browser console for the
Content-Security-Policy violation.
Expected behavior
The diagrams render as diagrams.
Additional context
The cause is not the diagram sources and not the Sphinx configuration. Both diagram sources parse
cleanly under mermaid 11.12.1, and the pinned CDN module returns HTTP 200.
sphinxcontrib-mermaiddefaults tomermaid_output_format = 'raw', which draws the diagrams in thereader's browser and emits:
The ASF serves
*.apache.orgwith aContent-Security-Policywhosescript-srcallows only'self',data:,blob:and a handful of apache.org / apachecon / scarf.sh hosts:cdn.jsdelivr.netis not on that list, so the browser blocks the import, mermaid.js never loads, andthe
<pre class="mermaid">blocks are left as text. The same header is served onairflow.apache.organdarrow.apache.org, so this is ASF infrastructure rather than anythingconfigured in this repository, and
.asf.yamlhas no knob for it.apache/arrowhits the same wall and works around it withmermaid_output_format = 'svg', whichpre-renders the diagrams with
mermaid-cliat build time and embeds them as<object data="../_images/mermaid-<hash>.svg" type="image/svg+xml">. That is served from'self'and needs no script, so the CSP does not apply. Their published pages render correctly.