Skip to content

Upgrade Markdown checks to 0.24 with patched parser dependencies - #16

Merged
kubbot merged 4 commits into
mainfrom
dependabot/npm_and_yarn/markdownlint-cli2-0.13.0
Oct 30, 2026
Merged

kubbot merged 4 commits into
mainfrom
dependabot/npm_and_yarn/markdownlint-cli2-0.13.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Apr 30, 2024 •

Copy link
Copy Markdown
Contributor

Upgrade the Markdown checks to markdownlint-cli2 0.24 on the current Node 22/Docsy baseline. The original 0.13 target still carries outdated parser dependencies; the current upstream release also needs two narrowly scoped security patches.

  • Restore the documented fix command with the supported markdownlint-cli2 --fix entry point.
  • Scope RE2JS 2.8.7 and KaTeX 0.18.2 overrides only below markdownlint 0.42.0. These are published security patch releases; no vendor source, rule ignore, or broad override is added.
  • Exercise the real fix command without changing tracked Markdown, real frontmatter/math tokenization, and a high-severity audit gate. All existing Docsy production, indexing, platform, and CodeQL checks remain.

Published head: bce976f2e007629aa30ebd75bcd6e8436e042129. Its three-platform CI and CodeQL have succeeded; exact job evidence is being recorded. The lock resolves all 184 package entries (including the root) from the public registry with integrity values. A read-only lock audit reports zero advisories at every severity as of the check. No host dependency installation or build was used. The math text fixture checks the linter's actual tokenizer; it is not a separate KaTeX rendering acceptance claim.

RE2JS security patch and KaTeX security patch.

Refs: GET-325.

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) from 0.4.0 to 0.13.0.
- [Changelog](https://github.com/DavidAnson/markdownlint-cli2/blob/main/CHANGELOG.md)
- [Commits](DavidAnson/markdownlint-cli2@v0.4.0...v0.13.0)

---
updated-dependencies:
- dependency-name: markdownlint-cli2
  dependency-type: direct:development
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label Apr 30, 2024
@vercel

vercel Bot commented Apr 30, 2024 •

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
website Ready Ready Preview Oct 30, 2026 8:01pm UTC

@netlify

netlify Bot commented Apr 30, 2024 •

Copy link
Copy Markdown

❌ Deploy Preview for openkf failed.

Name Link
🔨 Latest commit b25bf45
🔍 Latest deploy log https://app.netlify.com/sites/openkf/deploys/663098767f07fb0008f4a48c

Signed-off-by: kubbot <kubbot@users.noreply.github.com>
Signed-off-by: kubbot <kubbot@users.noreply.github.com>
Signed-off-by: kubbot <kubbot@users.noreply.github.com>
@kubbot kubbot changed the title build(deps-dev): bump markdownlint-cli2 from 0.4.0 to 0.13.0 Upgrade Markdown checks to 0.24 with patched parser dependencies Oct 30, 2026

@kubbot kubbot left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed the complete current-main diff, original PR ancestry and complete locked graph. CLI0.24 uses its supported --fix command; only markdownlint0.42 dependencies receive the precise RE2JS2.8.7/KaTeX0.18.2 patches. Current-head real three-OS CLI/fix/no-source-drift/parser-fixture/audit/Docsy tests, CodeQL and Vercel all passed. The audit snapshot reports zero advisories; this does not claim a real frontend exploit or hosted Pages acceptance.

@kubbot
kubbot merged commit ff37470 into main Oct 30, 2026
7 checks passed
@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/markdownlint-cli2-0.13.0 branch October 30, 2026 20:18

This branch was successfully deployed

1 active deployment
Preview — bce976f2 Deployed Oct 30, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant