[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing guidelines and Code of Conduct
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Security fix. This change updates the lockfile only.

markdown-it 15.0.2 -> 15.0.3

The root lockfile had one copy of markdown-it.
That copy was 15.0.2.
The lockfile now resolves markdown-it 15.0.3.

This release fixes CVE-2026-111758 (GHSA-gfr2-rv44-r23c).
The issue is a denial of service.
An unclosed reference definition makes parse time grow with the square of the input size.
The affected range is >= 15.0.0 < 15.0.3.
The patched release is 15.0.3.

@jaredwray/fumanchu 4.7.4 already accepts markdown-it ^15.0.2.
ecto 5.1.1 depends on @jaredwray/fumanchu ^4.7.3.
docula 3.0.1 depends on ecto.
The website package depends on docula.
No parent pins an exact markdown-it version.
This pull request adds no override.

Related lockfile updates

markdown-it 15.0.3 requires argparse ^3.0.3 and entities ^8.1.0.

• argparse 3.0.2 -> 3.0.3. Only markdown-it uses this copy.
• entities 8.0.0 -> 8.1.0 on the markdown-it edge. Other packages still resolve entities 8.0.0.

Versions that stay in place

@jaredwray/fumanchu stays at 4.7.4.
Release 4.7.5 depends on markdown-it ^15.0.3.
That release date is 2026-10-26.
The release age limit is 7 days, so pnpm rejects 4.7.5.
Safe Chain also hides 4.7.5 during metadata resolution.
The current parent range already accepts markdown-it 15.0.3.
This pull request adds no minimumReleaseAgeExclude entry.

http-cache-semantics stays at 4.2.0.
braces stays at 3.0.3.
No patched release exists for those two packages.

Other copies

The repository has one lockfile.
Docker Compose, Dockerfiles, and the CI configs do not pin markdown-it.

Test audit

This pull request adds no test.
It changes no test.
It deletes no test.
The test gate has no item.
No new test is required. The change is only the lockfile.

Checks

pnpm install --frozen-lockfile passed.
pnpm why markdown-it shows one copy: 15.0.3 via @jaredwray/fumanchu 4.7.4.
pnpm build passed.
node scripts/test-build.mjs passed.
pnpm -r --if-present lint passed.
pnpm test:ci passed for every workspace package.
@cacheable/net ran against TEST_URL=http://localhost:3737.
cacheable and cache-manager ran against Redis on port 6379.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T14:20:59.360533Z	6a3d2d3	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (06cf5b4) to head (6a3d2d3).

Additional details and impacted files

@@            Coverage Diff            @@
##              main     #1749   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           29        29           
  Lines         3620      3620           
  Branches       812       811    -1     
=========================================
  Hits          3620      3620           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.