[VatsalSy]

Description

Dependabot alert #81 reports low-severity prototype-pollution trust bypass in dev-scoped katex (GHSA-238p-pmpm-9mq7, affected versions below 0.18.2). Dependabot cannot open a clean security update: markdownlint-cli2 0.20.0 pulls micromark-extension-math 3.1.0, which requires katex@^0.16.0, and that range still excludes every patched release. The newest markdownlint-cli2 (0.23.3) and markdownlint (0.41.1) still pin micromark-extension-math 3.1.0, and that package's latest release is still 3.1.0, so a linter upgrade would not admit katex >= 0.18.2. This pins patched KaTeX with an npm override.

Type of Change

• Bug fix
• New feature
• Content update (Team/Publication)
• Documentation update
• Other (please describe)

Dependency-only security pin for transitive devDependency katex.

Changes Made

• Add overrides.katex = 0.19.0 in package.json. 0.18.11 is the last 0.18.x and is deprecated by upstream ("Accidentally published with breaking changes. Use 0.19.0 instead."). 0.19.0 includes the 0.18.2 fix.
• Regenerate package-lock.json so the resolved katex is 0.19.0 (and its nested commander 15.0.0). markdownlint-cli2 stays at 0.20.0.
• Leaves Dependabot PRs chore(deps): bump postcss-selector-parser from 7.1.5 to 7.1.6 #49 and chore(deps): bump source-map-js from 1.2.1 to 1.2.2 #50 untouched.

Testing Done

• Tested locally using bundle exec jekyll serve

• Checked all links and references

• Verified content formatting

• Cross-browser testing (if UI changes)

• npm ci --no-fund --no-audit --ignore-scripts succeeded on Node 22.23.3 / npm 10.9.9.

• npm audit no longer lists katex (remaining findings are pre-existing and out of scope, including postcss-selector-parser and source-map-js).

• npm run lint:md passed (markdownlint-cli2 v0.20.0, 10 files, 0 errors) with installed katex 0.19.0.

• npm test passed (11/11).

• bundle exec jekyll build succeeded (Ruby 3.2.3).

Screenshots

Related Issues

Dependabot alert #81 (katex). Does not close PRs #49 or #50.

Checklist

• Code follows the project's style guidelines
• All links are valid and working
• Images are optimized and properly sized
• Content is properly formatted
• Documentation has been updated (if needed)
• Changes have been tested locally

Additional Notes

node_modules/ is vendored in this repo and CI rejects pull requests that change it, so the committed tree still contains katex 0.16.27 until the next install. CI runs npm ci, which applies the override. 0.19.0 changes strict-mode handling for missing character metrics; markdown lint completed with zero errors against the site's Markdown.

  

[comphy-bot]

comphy-bot review status for comphy-lab/VatsalSy#55 at e879ae0b: completed

Review completed for this exact pull request head.

[comphy-bot]

Review: KaTeX security override

Reviewed exact head e879ae0b663b7efc04047d8b490c779db3aa6416: +9/-8 across package.json and package-lock.json.

No P0/P1 findings. The exact KaTeX override and lockfile resolution agree on 0.19.0; the lockfile also updates its nested commander dependency consistently. The override deliberately crosses the upstream transitive version range, so compatibility evidence matters. The reported clean install, Markdown lint and test results are consistent with the successful exact-head build check; I did not independently execute PR code or reproduce those commands.

Verification: reviewed both patches, dependency/runtime implications, current peer threads (no findings), successful build status, and the shared conflict-marker/whitespace checks. The deploy check is skipped. The new nested commander engine requirement is Node >=22.12.0; the reported validation used Node 22.23.3. No executable application logic changes or new behavioral test cases are required for this pin.