Repository navigation
chore(deps): override markdown-it 14.3.3 and fast-uri 4.2.3 (alerts #82–#87) - #56
Conversation
markdownlint-cli2 pins markdown-it 14.1.0; the existing override at 14.3.2 still falls short of GHSA-gfr2-rv44-r23c and GHSA-vfgh-jcmw-g37q. Pin the patched 14.3.3 release via overrides instead of taking a markdownlint-cli2 major that would also bump markdown-it to 15.x. Co-authored-by: Vatsal Sanjay | CoMPhy Lab <vatsal.sanjay@comphy-lab.org>
|
No actionable comments were generated in the recent review.
 |
| Layer / File(s) | Summary |
|---|---|
Update override versions package.json |
The fast-uri override changes from 4.2.1 to 4.2.3. The markdown-it override changes from 14.3.2 to 14.3.3. |
Estimated code review effort: 1 (Trivial) | ~3 minutes
Suggested reviewers: comphy-bot
Merge Risk: 
1d786
-
The override and lockfile updates are consistent, with no actionable merge-blocking risk identified. Normal checks can proceed.
Pre-merge checks: 
-
Check name Status Explanation Description Check Check skipped - CodeRabbit’s high-level summary is enabled. Title check The title clearly and concisely identifies both dependency override updates. It matches the changes in the pull request. Docstring Coverage No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat… Linked Issues check Check skipped because no linked issues were found for this pull request. Out of Scope Changes check Check skipped because no linked issues were found for this pull request. Full details: Docstring Coverage
-
Explanation
No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)
-
Finishing Touches
-
Simplify code
-
- Commit to this branch
- Create a new PR
-
- Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
|
comphy-bot review status for Review completed for this exact pull request head. |
comphy-bot
left a comment
comphy-bot
left a comment
There was a problem hiding this comment.
Review: markdown-it override patch
Reviewed exact head 18f9dcd809cb9ba468d96521f56b9cf854f528db: +4/-4 across package.json and package-lock.json.
Findings
No actionable findings. The exact override advances from 14.3.2 to 14.3.3 without a major-version expansion; the lockfile version and registry URL match that pin, with the integrity value updated and no unrelated dependency changes in the diff.
Verification
- Reviewed the manifest and lockfile changes together for dependency consistency and scope.
- Exact-head CI build succeeded; deploy was skipped. The packet also recorded a pending CodeRabbit status, which is not evidence of a defect.
- Central conflict-marker and trailing-whitespace checks passed.
- No peer review threads contained findings at packet collection.
- No PR code, install scripts, or test commands were executed during this review; the author-reported local tests were not independently rerun.
Bump the existing npm override from 4.2.1 to the patched 4.2.3 release so GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, and GHSA-333x-w4r6-6crp close with the markdown-it override already on this branch (alerts #82–#83).
cursor
Bot
changed the title
|
comphy-bot review status for Review completed for this exact pull request head. |
comphy-bot
left a comment
comphy-bot
left a comment
There was a problem hiding this comment.
Review: dependency security overrides
Reviewed exact head 1d7865f0ca2f8a8a9829ba2bc6a0b9bcc31f2f37 against base 4402c9f96fafe76e3ad7de988fbeac0190316c48: +8/-8 across two files.
Findings
No actionable findings. The manifest pins fast-uri to 4.2.3 and markdown-it to 14.3.3, preserving their existing major lines. Both lockfile entries match the new exact pins and registry URLs, with updated integrity values and no unrelated dependency changes. Parent cross-file inspection and the complete interfaces-unit review found no conflicting changes.
Verification
- All required coverage is complete: 1/1 validated units, plus parent inspection of the lockfile patch and cross-file consistency.
- Fresh exact-head checks: build and CodeRabbit succeeded; deploy was skipped. Central conflict-marker and trailing-whitespace checks passed.
- Fresh peer-thread review found no actionable findings to carry forward; the prior approval was for a different head and was not reused as this verdict.
- No executable application logic changed, so no complexity hotspot or new missing-test finding was identified.
- No PR code, installs, or test commands were executed during this review. Author-reported local tests and advisory-closure claims were not independently rerun or audited.
Description
Dependabot alerts #82 (high) and #83 (low) for
markdown-itare patched in 14.3.3. Alerts #84 (low), #85 (medium), #86 (low), and #87 (medium) forfast-uriare patched in 4.2.3.markdown-itenters the tree only throughmarkdownlint-cli2@0.20.0(pinned tomarkdown-it@14.1.0). An existing npm override already pinned 14.3.2 for earlier advisories; that version is still vulnerable to GHSA-gfr2-rv44-r23c and GHSA-vfgh-jcmw-g37q. This bumps the override to 14.3.3.fast-uriis already overridden at 4.2.1 (from earlier advisories). That pin is still vulnerable to GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, and GHSA-333x-w4r6-6crp. This bumps the override to 4.2.3 and regenerates the lockfile.Parent upgrade of
markdownlint-cli2was rejected: current latest pullsmarkdown-it@15.x(a major), which is out of scope for this security patch.Type of Change
Changes Made
overrides.markdown-itfrom14.3.2to14.3.3inpackage.jsonoverrides.fast-urifrom4.2.1to4.2.3inpackage.jsonpackage-lock.jsonso both resolve to the patched versionsTesting Done
npm run lint(js/css/md) — 0 errorsnpm test— 11/11 passed./scripts/check-phd-thesis-nav-docs.sh— passednpm ci— installsmarkdown-it@14.3.3andfast-uri@4.2.3via overridesJEKYLL_ENV=production bundle exec jekyll build— build completed successfullyRelated Issues
Closes Dependabot alerts #82, #83, #84, #85, #86, and #87 on merge (markdown-it 14.3.3 + fast-uri 4.2.3).
Checklist
Additional Notes
Same approach as PR #55 (
katexoverride): keep parent packages on the current minor and pin patched transitives withoverrides. No unrelated major bumps.Babysit status: MERGE_READY — CI build green, CodeRabbit pass (no actionable comments), comphy-bot APPROVED on exact head
1d7865f0, 0 unresolved threads. Not merged (per request).Summary by CodeRabbit