From b1946978f04619c7a47d9b81d943f59c958ab763 Mon Sep 17 00:00:00 2001 From: Zack Koppert Date: Mon, 19 Oct 2026 16:35:33 -0700 Subject: [PATCH] fix(deps): override vulnerable transitive KaTeX I require KaTeX 0.18.2 or newer for micromark-extension-math to address CVE-2026-103923. The lockfile resolves KaTeX 0.18.10 and its Commander dependency. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4d4fe4c6-b821-4449-99ea-80cd44d5b8f8 Signed-off-by: Zack Koppert --- package-lock.json | 16 ++++++++-------- package.json | 5 +++++ 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/package-lock.json b/package-lock.json index 2c3604b..a9c158c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -162,13 +162,13 @@ } }, "node_modules/commander": { - "version": "8.3.0", - "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz", - "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==", + "version": "15.0.0", + "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz", + "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==", "dev": true, "license": "MIT", "engines": { - "node": ">= 12" + "node": ">=22.12.0" } }, "node_modules/debug": { @@ -472,9 +472,9 @@ } }, "node_modules/katex": { - "version": "0.16.47", - "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz", - "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==", + "version": "0.18.10", + "resolved": "https://registry.npmjs.org/katex/-/katex-0.18.10.tgz", + "integrity": "sha512-/B6p9eY9DX7aHBfpkHdpirDTZ5QH9xTwL9y837PWuzuv41O5jFdqNQwVQEQsimY0/iVNkwBY4+4hMfhQ7d4Dbw==", "dev": true, "funding": [ "https://opencollective.com/katex", @@ -482,7 +482,7 @@ ], "license": "MIT", "dependencies": { - "commander": "^8.3.0" + "commander": "^15.0.0" }, "bin": { "katex": "cli.js" diff --git a/package.json b/package.json index bf4dcb6..66f7121 100644 --- a/package.json +++ b/package.json @@ -11,5 +11,10 @@ "devDependencies": { "markdownlint-cli2": "^0.23.3", "prettier": "^3.9.9" + }, + "overrides": { + "micromark-extension-math": { + "katex": "^0.18.2" + } } }