Update the KaTeX dependency tree past GHSA-238p-pmpm-9mq7 #494

New Issue

2026-10-19T12:35:38Z

excho0 commented

2026-10-19 12:35:38 +00:00

Problem

npm audit reports KaTeX 0.16.47 as affected by GHSA-238p-pmpm-9mq7 (>=0.11.0 <0.18.2). Dependabot security updates could not resolve the patched version because @streamdown/math@1.0.3 requires KaTeX ^0.16.27 and the installed Mermaid 11 dependency requires ^0.16.47.

TODO

Constrain KaTeX to a patched release (>=0.18.2) with the smallest maintainable dependency change; PR #501 applies the override and updates the lockfile.
Verify Markdown math and Mermaid rendering in the desktop renderer with an Electron regression test in #501.
Confirm npm audit no longer reports the KaTeX advisory and update the lockfile.
Document the compatibility reason for the override and when it can be removed in the PR.

Merged as #501 (509f929) on 19 October 2026; this issue is closed.

## Problem `npm audit` reports KaTeX `0.16.47` as affected by [GHSA-238p-pmpm-9mq7](https://github.com/advisories/GHSA-238p-pmpm-9mq7) (`>=0.11.0 <0.18.2`). Dependabot security updates could not resolve the patched version because `@streamdown/math@1.0.3` requires KaTeX `^0.16.27` and the installed Mermaid 11 dependency requires `^0.16.47`. ## TODO - [x] Constrain KaTeX to a patched release (>=0.18.2) with the smallest maintainable dependency change; PR #501 applies the override and updates the lockfile. - [x] Verify Markdown math and Mermaid rendering in the desktop renderer with an Electron regression test in #501. - [x] Confirm `npm audit` no longer reports the KaTeX advisory and update the lockfile. - [x] Document the compatibility reason for the override and when it can be removed in the PR. Merged as #501 (`509f929`) on 19 October 2026; this issue is closed.

rvnminers-A-and-N commented

2026-10-19 12:36:55 +00:00

@excho0 #493 fixes this. It pins katex to 0.18.11 with an npm override, because @streamdown/math, rehype-katex and mermaid still require 0.16. That is why Dependabot's security update failed on dev. I checked that inline and display math still render through the chat's remark-math → rehype-katex pipeline, and typecheck, unit tests and the build pass. If you'd rather wait for upstream @streamdown releases than override, say so and I'll close it.

@excho0 #493 fixes this. It pins `katex` to 0.18.11 with an npm override, because `@streamdown/math`, `rehype-katex` and `mermaid` still require 0.16. That is why Dependabot's security update failed on `dev`. I checked that inline and display math still render through the chat's `remark-math` → `rehype-katex` pipeline, and `typecheck`, unit tests and the build pass. If you'd rather wait for upstream `@streamdown` releases than override, say so and I'll close it.

excho0 commented

2026-10-19 12:44:17 +00:00

Published the focused fix as #501. The KaTeX lockfile now resolves to 0.18.10; the Electron test verifies math and Mermaid rendering, and npm audit no longer reports the KaTeX advisory. The complete local checks, including make cover at 100%, passed. The checklist above reflects the PR; I will close this issue on merge. /cc @rvnminers-A-and-N

Published the focused fix as #501. The KaTeX lockfile now resolves to 0.18.10; the Electron test verifies math and Mermaid rendering, and `npm audit` no longer reports the KaTeX advisory. The complete local checks, including `make cover` at 100%, passed. The checklist above reflects the PR; I will close this issue on merge. /cc @rvnminers-A-and-N

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Sisyphus/Sisyphus#494