It would be nice (and more secure) to have a fixed set of Antora dependencies that is only upgraded during logging-parent releases.
npm-shrinkwrap.json seems to be the right way to do it.