build(deps): override katex 0.18.2 and smol-toml 1.9.0

[sumitake]

Pull Request

Summary

• What changed: npm overrides now pin katex to 0.18.2 and smol-toml to 1.9.0. package-lock.json resolves those two dev packages and nothing else. markdownlint-cli2 stays 0.23.3. The CI step npm audit --omit=dev --audit-level=moderate is unchanged.
• Why: Dependabot alerts build(deps): bump actions/checkout from 4.3.1 to 7.0.1 #7 and Rename project from Remote-SSH-Tunnel to VSC-RemoteSSH #8 are both in the markdownlint-cli2 dev chain. The existing smol-toml 1.7.1 override (PR build(deps): override smol-toml to 1.7.1 (Dependabot alert #3) #34, alert build(deps): bump gitleaks/gitleaks-action from 2.3.9 to 3.0.0 #3) is still inside GHSA-r4xh-jqrq-34v2 (<=1.8.0), so Dependabot cannot move it. katex 0.16.47 is inside GHSA-238p-pmpm-9mq7 (<0.18.2). micromark-extension-math 3.1.0 (latest, pinned by markdownlint 0.41.1) requests katex@^0.16.0, and markdownlint-cli2 0.23.3 (latest) requests smol-toml@1.8.0, so neither patched release is reachable without an override. PR ci: bump axios to 1.20.0 and audit production dependencies #47 left these in place because braces has no patched release and npm audit fix --force would downgrade markdownlint-cli2. These two advisories now have patched targets that do not require that downgrade.

Lockfile version delta

Package	Before	After
katex (node_modules/katex)	0.16.47	0.18.2
smol-toml (node_modules/smol-toml)	1.7.1	1.9.0

uuid stays overridden at 11.1.1. No other locked package version changed.

Verification

Local commands on this tip (Node v22.14.0, npm 10.9.7):

• npm ci --ignore-scripts — exit 0. Added 151 packages. npm ls shows katex@0.18.2 overridden and smol-toml@1.9.0 overridden under markdownlint-cli2 0.23.3.
• npm run check — exit 0. 20 tests, 20 pass, 0 fail.
• npm run lint:markdown — exit 0. markdownlint-cli2 v0.23.3 (markdownlint v0.41.1), 9 files, 0 issues. That command loads both packages: the math extension imports KaTeX, and the CLI statically imports smol-toml parse.
• Direct call-site smoke (not committed): katex.renderToString on inline and display math, and markdownlint-cli2/parsers/toml on a sample config, both succeeded on the overridden versions.
• npm audit --omit=dev --audit-level=moderate — exit 0. found 0 vulnerabilities.
• npm audit --audit-level=moderate — exit 1 (dev-only braces; not the CI step). katex and smol-toml are gone. Output:

# npm audit report

braces  *
Severity: high
braces vulnerable to stack-exhaustion denial of service through deeply nested patterns - https://github.com/advisories/GHSA-vfj7-8cjw-p6xm
fix available via `npm audit fix --force`
Will install markdownlint-cli2@0.0.4, which is a breaking change
node_modules/braces
  micromatch  >=0.2.0
  Depends on vulnerable versions of braces
  node_modules/micromatch
    fast-glob  *
    Depends on vulnerable versions of micromatch
    node_modules/fast-glob
      globby  >=8.0.0
      Depends on vulnerable versions of fast-glob
      Depends on vulnerable versions of micromatch
      node_modules/globby
        markdownlint-cli2  >=0.0.5
        Depends on vulnerable versions of globby
        Depends on vulnerable versions of micromatch
        node_modules/markdownlint-cli2

5 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

• Node tests and executable smoke check pass
• Python tests, Ruff lint, and Ruff format checks pass (not run locally; this diff does not touch Python)
• Dependency audit and repository validator pass (runtime npm audit --omit=dev --audit-level=moderate exits 0; repository validator runs in CI)
• No real credentials, tunnel metadata, hostnames, usernames, or private paths are present
• Microsoft-derived assets remain isolated and attributed
• User-visible changes are documented in CHANGELOG.md (no user-visible change)

Security impact

Dev-only katex moves from 0.16.47 to 0.18.2 (GHSA-238p-pmpm-9mq7, alert #7) and dev-only smol-toml moves from 1.7.1 to 1.9.0 (GHSA-r4xh-jqrq-34v2, alert #8; 1.9.0 still includes the 1.7.1 fix for GHSA-7w5x-hrqm-74c2). The runtime audit is unchanged and still exits 0. braces (GHSA-vfj7-8cjw-p6xm) stays unfixed: there is still no patched release, and clearing it still requires a breaking downgrade of markdownlint-cli2. Authentication, port exposure, command execution, protocol parsing, output handling, services, and licensing are unchanged.

  

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 01c69a18-b08e-4a0b-a3a0-f15d4b520b4b

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T14:15:42.653763Z	dffdb81	PR opened
🔒 Security Review	✅ Completed 2026-10-07T14:16:51.567123Z	dffdb81	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.