[jaredwray]

Please check if the PR fulfills these requirements

• Followed the Contributing and Code of Conduct guidelines.
• Tests for the changes have been added (for bug fixes/features) with 100% code coverage.

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Security fix. No application code changes. The existing suite still passes at 100% coverage.

Summary

Refresh the lockfile so the only markdown-it copy resolves to 15.0.3. writr 6.1.6 and docula 3.0.2 are already the newest published releases, and neither pulls markdown-it itself. The vulnerable copy comes from @jaredwray/fumanchu. braces@3.0.3 and http-cache-semantics@4.2.0 are unchanged; neither has a published fix.

No other markdown-it pin exists in this repo (no other lockfile, Dockerfile, or CI config).

Package	From	To	Advisory
@jaredwray/fumanchu	4.7.4	4.7.5	Parent bump. 4.7.5 depends on markdown-it@^15.0.3. Direct range in package.json is now ^4.7.5. Nested ecto@5.1.1 (via docula@3.0.2) requests ^4.7.3, so it resolves to the same 4.7.5 copy. No override.
markdown-it	15.0.2	15.0.3	GHSA-gfr2-rv44-r23c / CVE-2026-111758. Quadratic-time rendering of an unclosed multi-line link reference definition. Fixed in 15.0.3 (15.0.0–15.0.2 are affected). 15.0.2 already includes the CVE-2026-111759 fix.
chrono-node	2.10.1	2.10.3	Transitive. fumanchu 4.7.5 pins chrono-node@2.10.3. Published 2026-10-12, outside the cooldown.
argparse	3.0.2	3.0.3	Transitive. markdown-it@15.0.3 depends on it. Published 2026-10-15, outside the cooldown.
entities	8.0.0 (markdown-it only)	8.1.0	Transitive. markdown-it@15.0.3 depends on entities@^8.1.0. The existing entities@8.0.0 copy stays for other parents. Published 2026-09-07.

minimumReleaseAgeExclude

Needs Jared's sign-off.

minimumReleaseAge is 10080 minutes (7 days) with minimumReleaseAgeStrict: true. @jaredwray/fumanchu@4.7.5 was published 2026-10-26, so it is inside the cooldown. One exact-version entry was added in pnpm-workspace.yaml:

• @jaredwray/fumanchu@4.7.5

markdown-it@15.0.3 (published 2026-10-16) is outside the cooldown, so it has no exclude. No other minimumReleaseAgeExclude entries were added. DEFENSE_IN_DEPTH.md records this exception as still needing sign-off.

Test plan

• pnpm why markdown-it shows only markdown-it@15.0.3 via @jaredwray/fumanchu@4.7.5 (root and nested ecto@5.1.1 through docula). braces@3.0.3 and http-cache-semantics@4.2.0 stay put.
• pnpm install --frozen-lockfile, pnpm build, and pnpm test on Node 22.22.2 — 261 tests, 100% coverage.
• GitHub Actions tests (22), tests (24), tests (26), and code-coverage passed on this PR.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-28T14:18:34.016221Z	e4a010d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​jaredwray/​fumanchu@​4.7.4 ⏵ 4.7.5	+4

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (d0a2dd5) to head (e4a010d).

Additional details and impacted files

@@            Coverage Diff            @@
##              main      #450   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files            9         9           
  Lines          438       438           
  Branches       102       102           
=========================================
  Hits           438       438           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.