Repository navigation
chore(knowledge-ui): resolve open Dependabot alerts (vue, katex, source-map-js, sharp) - #138
Merged
Merged
Conversation
Bumps [katex](https://github.com/KaTeX/KaTeX) from 0.16.47 to 0.18.2. - [Release notes](https://github.com/KaTeX/KaTeX/releases) - [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md) - [Commits](KaTeX/KaTeX@v0.16.47...v0.18.2) --- updated-dependencies: - dependency-name: katex dependency-version: 0.18.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [source-map-js](https://github.com/7rulnik/source-map-js) from 1.2.1 to 1.2.2. - [Release notes](https://github.com/7rulnik/source-map-js/releases) - [Changelog](https://github.com/7rulnik/source-map-js/blob/main/CHANGELOG.md) - [Commits](7rulnik/source-map-js@v1.2.1...v1.2.2) --- updated-dependencies: - dependency-name: source-map-js dependency-version: 1.2.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
Bumps [sharp](https://github.com/lovell/sharp) from 0.35.4 to 0.35.5. - [Release notes](https://github.com/lovell/sharp/releases) - [Commits](lovell/sharp@v0.35.4...v0.35.5) --- updated-dependencies: - dependency-name: sharp dependency-version: 0.35.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
…e-ui/source-map-js-1.2.2' into chore/knowledge-ui-security-2026-10-10
…e-ui/sharp-0.35.5' into chore/knowledge-ui-security-2026-10-10
…down-it-katex - vue ^3.5.42 (resolves 3.5.43) fixes the @vue/server-renderer attribute-name XSS advisory; all @vue/* runtime packages move to 3.5.43 together. - @vscode/markdown-it-katex pins katex ^0.16.4, so it kept a nested 0.16.47 that still carried the katex advisory and rendered pre-0.18 markup while MarkdownTab imports the 0.18 stylesheet (0.18 prefixed internal classes). An override points it at the top-level katex. - Unit test asserts rendered markup carries the 0.18 class names. Claude-Session: https://claude.ai/code/session_017PagRVvcXuoEPBJArfTGgf
This was referenced Oct 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves all open Dependabot alerts in
knowledge-ui/package-lock.jsonand supersedes #135, #136, #137.Alerts fixed
@vue/server-renderer(attribute-name XSS, missing CR in blacklist)vuebumped to^3.5.42; all@vue/*runtime packages aligned at 3.5.43source-map-jssharp(dev)katex(prototype pollution bypassingtrust)npm audit: 0 vulnerabilities.KaTeX 0.16 -> 0.18 breaking-change analysis
__defineFunctionAPI changed (no morepropswrapper). We don't use it.base->katex-base,strut->katex-strut,sizing->katex-sizing, ...). Our code only references.katex/.katex-display, which didn't change, and we have no custom styles that target internal classes.@vscode/markdown-it-katex, which declareskatex: ^0.16.4. With only build(deps): bump katex from 0.16.47 to 0.18.2 in /knowledge-ui #135 merged, the plugin kept a nestedkatex@0.16.47, which (a) still had the vulnerable version in the lockfile, sonpm auditkept flagging it, and (b) produced 0.16 markup with unprefixed classes whileMarkdownTab.vueloads the 0.18katex.min.css, so formulas would have rendered without styling.overridesentry"@vscode/markdown-it-katex": { "katex": "$katex" }dedupes the plugin onto the top-level katex 0.18.2. The plugin only callskatex.renderToString(latex, { ...options, displayMode }), and that API is unchanged.tests/unit/markdownTabKatex.spec.tschecks that the rendered markup contains.katex-base/.katex-strutand no.base. It failed before the override and passes after it. The existing inline, display, code-span and dollar-amount cases still pass.Verification (local,
knowledge-ui)npm ci: OKnpm run build(vue-tsc + vite): OKnpm run test:unit: 105 files, 501 tests passednpm audit: 0 vulnerabilities"dev": truecount matches main (546), so there's no flag churn.https://claude.ai/code/session_017PagRVvcXuoEPBJArfTGgf