[CalinaCristian]

Description

Fixes CVE-2026-103923 / GHSA-238p-pmpm-9mq7 (katex <0.18.2: settings prototype pollution bypasses trust). The finding shows in MER for Experiences, which consumes @uipath/apollo-react.

• apollo-react: katex ^0.16.27 → ^0.18.11
• pnpm-workspace.yaml: adds a katex: "^0.18.11" override, because mermaid, rehype-katex and micromark-extension-math still pin ^0.16. Removes the advisory from auditConfig.ignoreGhsas.
• pnpm-lock.yaml now contains only katex@0.18.11.

Why 0.18.11: it's the latest 0.18.x past the 14-day minimumReleaseAge (published 2026-10-01), so no exemption is needed. Releases 0.18.3–0.18.11 are fixes and features only.

Risks of rolling out

KaTeX 0.18.0 prefixes its generic CSS classes (accent, sizing, vbox, strut, … → katex-*). This is safe here because:

• ap-chat markdown imports katex/dist/katex.min.css from the same resolved package as the renderer, so markup and styles stay in sync;
• Apollo only targets the root .katex class (ap-chat '&, & .katex', apollo-wind [&>.katex]), which keeps its name.

Consumers that bundle apollo-react get the new katex through the dependency. Anyone with their own CSS on KaTeX's internal classes would need to update it.

Validation

• turbo build for apollo-react and apollo-wind: 4/4 tasks pass.
• tsc --noEmit: apollo-react and apollo-wind both clean.
• apollo-wind markdown.test.tsx 19/19 (asserts .katex / .katex > math); ap-chat 19/19.
• apollo-react full suite: 4052/4053. The one failure is JsonTree.import.test.ts, a 5s timeout under full-suite load that passes in isolation.

🤖 Generated with Claude Code

[github-actions]

Apollo Coded App preview deployments are ready.

Project	Status	Preview	Updated (PT)
apollo-design	Ready	Preview · Logs	Oct 15, 2026, 10:29:04 PM
apollo-docs	Ready	Preview · Logs	Oct 15, 2026, 10:29:04 PM
apollo-landing	Ready	Preview · Logs	Oct 15, 2026, 10:29:04 PM
apollo-vertex	Ready	Preview · Logs	Oct 15, 2026, 10:29:04 PM

[github-actions]

📊 Coverage + size by package

Per-package bundle size on this PR (no JS/TS source changes detected under packages/* or web-packages/*).

Package	Coverage	New-line coverage	Packed (gzip)	Unpacked	vs main
@uipath/apollo-core	75.0%	—	42.02 MB	50.17 MB	±0
@uipath/apollo-react	51.3%	—	7.99 MB	31.45 MB	+2 B
@uipath/apollo-ui-icons	—	—	2.86 MB	6.97 MB	±0
@uipath/apollo-vertex	84.0%	—	325.5 KB	1.84 MB	±0
@uipath/apollo-wind	79.0%	—	785.2 KB	4.55 MB	−32 B
@uipath/ap-chat	85.8%	—	40.37 MB	45.58 MB	+855 B

_{"Coverage" is each package's own coverage.include scope (e.g. apollo-core instruments only scripts/). "Packed"/"Unpacked" come from npm pack --dry-run and only cover built packages — "—" means not measured this run (package not affected / not built). "vs main" is the packed (gzipped) delta against the last successful main build (the package-sizes artifact from the Release workflow); "—" there means no main baseline was available this run. The baseline is main's latest build, not this PR's exact merge-base, so it includes any drift since the branch diverged. Packages with no vitest config are omitted.}

[github-actions]

Storybook visual diff

✅ No stories are affected by this PR's changes; nothing to compare. Logs

Updated (PT): Oct 15, 2026, 10:29:58 PM

[CalinaCristian]

Update: pinned katex to exactly 0.18.10. 0.18.11 is deprecated upstream: it was accidentally published with 0.19.0's breaking change. Also fixed the lockfile: two @uipath/* entries had picked up npm.pkg.github.com tarball URLs from a local npmrc. That's what caused the ERR_PNPM_FETCH_401 in every CI job.

[github-actions]

Dependency License Review

• ✅ 1942 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1708
ISC	91
Apache-2.0	56
BSD-3-Clause	28
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
MIT-0	3
CC0-1.0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.3.4	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json