Repository navigation
Conversation
markdownlint-cli2 pins markdown-it 14.1.0; the existing override at 14.3.2 still falls short of GHSA-gfr2-rv44-r23c and GHSA-vfgh-jcmw-g37q. Pin the patched 14.3.3 release via overrides instead of taking a markdownlint-cli2 major that would also bump markdown-it to 15.x. Co-authored-by: Vatsal Sanjay | CoMPhy Lab <vatsal.sanjay@comphy-lab.org>
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update override version package.json |
The markdown-it override changes from version 14.3.2 to 14.3.3. |
Priority:
Estimated code review effort: 1 (Trivial) | ~3 minutes
Change: Other
Suggested reviewers: cursoragent
Merge Risk: 
18f9d
-
The dependency override update is ready to merge based on the available review evidence.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly identifies the dependency update to markdown-it 14.3.3 and links it to Dependabot alerts #82and#83. It accurately summarises the main change.Docstring Coverage No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
✨ Simplify code
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Comment @coderabbitai help to get the list of available commands.
|
comphy-bot review status for Review completed for this exact pull request head. |
comphy-bot
left a comment
comphy-bot
left a comment
There was a problem hiding this comment.
Review: markdown-it override patch
Reviewed exact head 18f9dcd809cb9ba468d96521f56b9cf854f528db: +4/-4 across package.json and package-lock.json.
Findings
No actionable findings. The exact override advances from 14.3.2 to 14.3.3 without a major-version expansion; the lockfile version and registry URL match that pin, with the integrity value updated and no unrelated dependency changes in the diff.
Verification
- Reviewed the manifest and lockfile changes together for dependency consistency and scope.
- Exact-head CI build succeeded; deploy was skipped. The packet also recorded a pending CodeRabbit status, which is not evidence of a defect.
- Central conflict-marker and trailing-whitespace checks passed.
- No peer review threads contained findings at packet collection.
- No PR code, install scripts, or test commands were executed during this review; the author-reported local tests were not independently rerun.
Description
Dependabot alerts #82 (high) and #83 (low) for
markdown-itare patched in 14.3.3. The package enters the tree only throughmarkdownlint-cli2@0.20.0(pinned tomarkdown-it@14.1.0). An existing npm override already pinned 14.3.2 for earlier advisories, but that version is still vulnerable to GHSA-gfr2-rv44-r23c and GHSA-vfgh-jcmw-g37q. This bumps the override to 14.3.3 and regenerates the lockfile.Parent upgrade of
markdownlint-cli2was rejected: current latest pullsmarkdown-it@15.x(a major), which is out of scope for this security patch.Type of Change
Changes Made
overrides.markdown-itfrom14.3.2to14.3.3inpackage.jsonpackage-lock.jsonsonode_modules/markdown-itresolves to 14.3.3Testing Done
npm run lint(js/css/md) — 0 errorsnpm test— 11/11 passed./scripts/check-phd-thesis-nav-docs.sh— passednpm ci— installsmarkdown-it@14.3.3via override./scripts/build.sh(Jekyll) — build completed successfullyRelated Issues
Closes Dependabot alerts #82 and #83 on merge (both patched in markdown-it 14.3.3).
Checklist
Additional Notes
Same approach as PR #55 (
katexoverride): keepmarkdownlint-cli2on the current minor and pin the patched transitive withoverrides.Babysit status: MERGE_READY — CI build green, CodeRabbit pass, comphy-bot APPROVED on exact head, 0 unresolved threads. Not merged (per request).
Summary by CodeRabbit