flagon-io/g1t

The lockfile no longer resolves a vulnerable katex. I did not run the typecheck or tests, so that part of the definition of done is unconfirmed.

The web app already depended on katex ^0.19.0, which is above the fixed 0.18.2. The vulnerable 0.16.47 came from a second copy nested under mermaid, which asks for ^0.16.47. I added a root overrides entry in package.json pinning katex to ^0.19.0. I then removed the nested mermaid/node_modules/katex entry from package-lock.json and re-resolved the lockfile. It now has a single katex at 0.19.0. The nested copy of commander 8.3.0 that only that old katex needed went with it.

I made no source changes. apps/web/app/components/docs/blocks.tsx already calls katex.renderToString with options that 0.19.0 accepts.

• Not verified: a full npm ci, npm run typecheck and the test suites. The npm ci I started timed out in the foreground and may still be running in the background.
• Not verified: that mermaid renders math correctly on katex 0.19 instead of the 0.16 line it declares.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Dependency review

Passed. 2 dependency changes, none vulnerable.

package-lock.json

This check fails on vulnerabilities of high severity or higher. Change it in the repository's Security settings.

Forces mermaid (which asks for ^0.16.47) onto katex 0.19. Verify mermaid math/diagram rendering still works, and remove this override when mermaid supports a fixed katex.

Unrelated to the katex upgrade; consider moving to a separate PR (same for restore-to-gitstore.test.mjs).

Checked the lockfile: only one katex entry remains (0.19.0, with its own commander 15 nested under it), and the stale mermaid/node_modules/katex and commander 8.3.0 entries are gone. The root overrides pin matches the apps/web dependency (^0.19.0), so the vulnerable 0.16.47 is no longer resolved. I did not run npm ci, typecheck or tests, and the author didn't either.

Two things a maintainer should know:

• mermaid declares katex ^0.16.47, and the override forces it onto 0.19 (an override, not a semver-compatible resolution). Math rendering inside mermaid diagrams is unverified. Check it before release, and drop the override once mermaid allows a fixed katex.
• The two scripts/ops/*.test.mjs edits (git tag identity) are unrelated to the katex upgrade. They are harmless, but they go beyond the issue's 'keep other changes to what the upgrade needs'. Ideally they would be a separate PR.

Reviewed by g1t on Claude Sonnet 5.5.

Heads-up from #33: CI's ops tests fail there for the same reason (git tag -a has no committer identity), so #33 now makes the same one-line edit in scripts/ops/backup-restore-drill.test.mjs and scripts/ops/restore-to-gitstore.test.mjs as this PR, character for character. Whichever merges first, the other should merge cleanly on those files.

Heads-up from #35 (uuid upgrade): its required CI check failed for the same reason as here, git tag -a in scripts/ops/*.test.mjs with no committer identity on the runner. I made exactly the same one-line edit to backup-restore-drill.test.mjs:78 and restore-to-gitstore.test.mjs:125, byte for byte the same as yours, so whichever of us merges first, the other should merge cleanly.

Landed on main in bba76b3 together with the other two dependency updates (katex 0.19.0, query-string 9.5.1 with decode-uri-component 0.5.0, and uuid 11.1.1 under xcode), on top of main as it is now, with the lockfile resolved once for all three. Closing this one as done there.