From 18f9dcd809cb9ba468d96521f56b9cf854f528db Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 26 Oct 2026 10:50:25 +0000 Subject: [PATCH 1/2] chore(deps): override markdown-it to 14.3.3 (alerts #82, #83) markdownlint-cli2 pins markdown-it 14.1.0; the existing override at 14.3.2 still falls short of GHSA-gfr2-rv44-r23c and GHSA-vfgh-jcmw-g37q. Pin the patched 14.3.3 release via overrides instead of taking a markdownlint-cli2 major that would also bump markdown-it to 15.x. Co-authored-by: Vatsal Sanjay | CoMPhy Lab --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index 8dfe2713..dd41de9f 100644 --- a/package-lock.json +++ b/package-lock.json @@ -8410,9 +8410,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.2", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.2.tgz", - "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==", + "version": "14.3.3", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz", + "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index 93b92085..a45ca77f 100644 --- a/package.json +++ b/package.json @@ -43,7 +43,7 @@ "json": ">=2.21.2", "katex": "0.19.0", "linkify-it": ">=5.0.2", - "markdown-it": "14.3.2", + "markdown-it": "14.3.3", "postcss": ">=8.5.23" }, "devDependencies": { From 1d7865f0ca2f8a8a9829ba2bc6a0b9bcc31f2f37 Mon Sep 17 00:00:00 2001 From: Vatsal Sanjay | CoMPhy Lab Date: Mon, 2 Nov 2026 10:45:12 +0000 Subject: [PATCH 2/2] =?UTF-8?q?chore(deps):=20override=20fast-uri=20to=204?= =?UTF-8?q?.2.3=20(alerts=20#84=E2=80=93#87)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Bump the existing npm override from 4.2.1 to the patched 4.2.3 release so GHSA-w74x-v6f9-j3xg, GHSA-xhq7-xmqj-769h, GHSA-wjr9-j795-jxcr, and GHSA-333x-w4r6-6crp close with the markdown-it override already on this branch (alerts #82–#83). --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index dd41de9f..8b910c14 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4477,9 +4477,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "4.2.1", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.1.tgz", - "integrity": "sha512-TmHQgewjHtMq1E5QKA0tOE0yeYGQs25KZC/ziJpubRtWI15W92e6vPFydWOeZBVROSHBYw/QhD9d5OefdD6LDg==", + "version": "4.2.3", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-4.2.3.tgz", + "integrity": "sha512-I1PXwP5eAhlNlcdpjt9CgB59op2ZvZfxw+BkqGFVIUOgNpCVTcTqp3HhTX7brxj5vsip+nSY4nTvff+eIA76hg==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index a45ca77f..822601da 100644 --- a/package.json +++ b/package.json @@ -37,7 +37,7 @@ "homepage": "https://comphy-lab.org/vatsalsy", "overrides": { "brace-expansion": "1.1.21", - "fast-uri": "4.2.1", + "fast-uri": "4.2.3", "form-data": "4.0.4", "js-yaml": "4.3.2", "json": ">=2.21.2",