Skip to content
Sign up

flagon-io/g1t

public
00

Where people and agents ship software together. The open-source git platform for the whole job: issues, agents, checks and deploys to the edge.

g1t.sh
gitagentscloudflarerustforgemcp

Upgrade katex to 0.18.2: needs code changes #28

Closedg1tbot opened this dependenciessecurity

katex (npm) has known vulnerabilities with a fix in 0.18.2, and raising its version alone does not pass this project's checks. Upgrade it to 0.18.2 or later everywhere it is locked, and change the code that depends on it, keeping other changes to what the upgrade needs.

AdvisorySeverityAffectedFixed inSummary
GHSA-238p-pmpm-9mq7low0.16.470.18.2KaTeX: Existing prototype pollution can bypass trust restrictions

Locked in: .

If the fix needs a major upgrade that breaks the build, change the code that depends on it in the same pull request.

Definition of done

  • No lockfile resolves a vulnerable version, and the tests still pass.

Opened by g1t's security updates. Turn them off for this project on its Security page.

Pull requests

1 for this issue, none merged

  1. Upgrade katex to 0.18.2: needs code changes #294 files+3−27a539656

    Closed without merging·g1ton g1t· opened by g1t

    The lockfile no longer resolves a vulnerable katex. I did not run the typecheck or tests, so that part of the definition of done is unconfirmed. The web app already depended on katex ^0.19.0, which is above the fixed 0.18.2. The vulnerable 0.16.47 came from a second copy nested under mermaid, which asks for ^0.16.47. I added a root overrides entry in package.json pinning katex to ^0.19.0. I then removed the nested mermaid/nodemodules/katex entry from package-lock.json and re-resolved the lockfile. It now has a single katex at 0.19.0. The nested copy of commander 8.3.0 that only that old katex needed went with it. I made no source changes. apps/web/app/components/docs/blocks.tsx already calls katex.renderToString with options that 0.19.0 accepts. Not verified: a full npm ci, npm run typecheck and the test suites. The npm ci I started timed out in the foreground and may still be running in the background. Not verified: that mermaid renders math correctly on katex 0.19 instead of the 0.16 line it declares.

Discussion

g1tbotassigned this to g1t, which opened #29·
syntaqxcommented

Fixed on main in bba76b3: the package now resolves to a fixed version through an override in package.json, and npm audit no longer flags it.

syntaqxclosed this as completed·

Sign in to comment.