diff --git a/packages/apollo-react/package.json b/packages/apollo-react/package.json index 5117b7300..8c62320ff 100644 --- a/packages/apollo-react/package.json +++ b/packages/apollo-react/package.json @@ -241,7 +241,7 @@ "date-fns": "^4.1.0", "debounce": "^3.0.0", "html-to-image": "^1.11.11", - "katex": "^0.16.27", + "katex": "0.18.10", "lexical": "0.42.0", "lodash": "^4.18.1", "lucide-react": "^0.577.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index e63c6d77c..bdd8102b4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -35,6 +35,7 @@ overrides: svgo@>=3.0.0 <4: ^3.3.5 svgo@>=4.0.0: ^4.1.0 colord: 2.9.4 + katex: 0.18.10 packageExtensionsChecksum: sha256-MiSYq8DXxufYD2Uu5iQfUDBUnmlvtj4LBvzJl3bvsgA= @@ -599,8 +600,8 @@ importers: specifier: ^1.11.11 version: 1.11.13 katex: - specifier: ^0.16.27 - version: 0.16.27 + specifier: 0.18.10 + version: 0.18.10 lexical: specifier: 0.42.0 version: 0.42.0 @@ -8268,6 +8269,10 @@ packages: resolution: {integrity: sha512-TywoWNNRbhoD0BXs1P3ZEScW8W5iKrnbithIl0YH+uCmBd0QpPOA8yc82DS3BIE5Ma6FnBVUsJ7wVUDz4dvOWQ==} engines: {node: '>=20'} + commander@15.0.0: + resolution: {integrity: sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==} + engines: {node: '>=22.12.0'} + commander@2.20.3: resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==} @@ -8279,10 +8284,6 @@ packages: resolution: {integrity: sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==} engines: {node: '>= 10'} - commander@8.3.0: - resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==} - engines: {node: '>= 12'} - commitizen@4.3.1: resolution: {integrity: sha512-gwAPAVTy/j5YcOOebcCRIijn+mSjWJC+IYKivTu6aG8Ei/scoXgfsMRnuAk6b0GRste2J4NGxVdMN3ZpfNaVaw==} engines: {node: '>= 12'} @@ -10588,12 +10589,8 @@ packages: resolution: {integrity: sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==} engines: {node: '>=18'} - katex@0.16.27: - resolution: {integrity: sha512-aeQoDkuRWSqQN6nSvVCEFvfXdqo1OQiCmmW1kc9xSdjutPv7BGO7pqY9sQRJpMOGrEdfDgF2TfRXe5eUAD2Waw==} - hasBin: true - - katex@0.16.45: - resolution: {integrity: sha512-pQpZbdBu7wCTmQUh7ufPmLr0pFoObnGUoL/yhtwJDgmmQpbkg/0HSVti25Fu4rmd1oCR6NGWe9vqTWuWv3GcNA==} + katex@0.18.10: + resolution: {integrity: sha512-/B6p9eY9DX7aHBfpkHdpirDTZ5QH9xTwL9y837PWuzuv41O5jFdqNQwVQEQsimY0/iVNkwBY4+4hMfhQ7d4Dbw==} hasBin: true keyv@4.5.4: @@ -21366,14 +21363,14 @@ snapshots: commander@14.0.2: {} + commander@15.0.0: {} + commander@2.20.3: {} commander@4.1.1: {} commander@7.2.0: {} - commander@8.3.0: {} - commitizen@4.3.1(@types/node@24.10.1)(typescript@5.9.3): dependencies: cachedir: 2.3.0 @@ -24030,13 +24027,9 @@ snapshots: jwt-decode@4.0.0: {} - katex@0.16.27: - dependencies: - commander: 8.3.0 - - katex@0.16.45: + katex@0.18.10: dependencies: - commander: 8.3.0 + commander: 15.0.0 keyv@4.5.4: dependencies: @@ -24629,7 +24622,7 @@ snapshots: dayjs: 1.11.20 dompurify: 3.4.16 es-toolkit: 1.46.1 - katex: 0.16.45 + katex: 0.18.10 khroma: 2.1.0 marked: 16.4.2 roughjs: 4.6.6 @@ -24727,7 +24720,7 @@ snapshots: dependencies: '@types/katex': 0.16.7 devlop: 1.1.0 - katex: 0.16.27 + katex: 0.18.10 micromark-factory-space: 2.0.1 micromark-util-character: 2.1.1 micromark-util-symbol: 2.0.1 @@ -25099,7 +25092,7 @@ snapshots: fast-glob: 3.3.3 github-slugger: 2.0.0 hast-util-to-estree: 3.1.3 - katex: 0.16.27 + katex: 0.18.10 mdast-util-from-markdown: 2.0.2 mdast-util-gfm: 3.1.0 mdast-util-to-hast: 13.2.1 @@ -26534,7 +26527,7 @@ snapshots: '@types/katex': 0.16.7 hast-util-from-html-isomorphic: 2.0.0 hast-util-to-text: 4.0.2 - katex: 0.16.27 + katex: 0.18.10 unist-util-visit-parents: 6.0.2 vfile: 6.0.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ec2e7c881..51189a79c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -67,11 +67,11 @@ overrides: "svgo@>=3.0.0 <4": "^3.3.5" # GHSA-w27v-7q3p-w38r (high, removeScripts namespace/control-char bypass) + GHSA-4vpr-x523-8j87 (moderate, foreignObject sanitization) — v3 backport; transitive via @svgr/webpack>@svgr/plugin-svgo (^3.0.2) "svgo@>=4.0.0": "^4.1.0" # same two advisories on the v4 line (no 4.0.x patch) — transitive via cssnano>postcss-svgo (^4.0.0); 4.1.0 also bumps sax 1.6.1 / css-what ^7 / css-select ^6 (all long-aged, maintainers unchanged) colord: "2.9.4" # GHSA-2wm5-q62r-hmrv (moderate, quadratic backtracking rejecting oversized malformed color strings) — transitive via cssnano>postcss-colormin (^2.9.3) and stylelint (^2.9.3). Pinned exact: ^2.9.4 would reach 2.10.0 (feature release, unvetted). No npm provenance on any colord release (classic token publish); publisher omgovich unchanged since 2021 and fix commit 8701808 "reject malformed color strings in linear time" (#141) matches the advisory + katex: "0.18.10" # GHSA-238p-pmpm-9mq7 / CVE-2026-103923 (low, prototype pollution in settings bypasses `trust`; patched 0.18.2) — mermaid, rehype-katex, micromark-extension-math, nextra all still pin ^0.16, so force the 0.18 line. 0.18.0 prefixes KaTeX's generic CSS classes (accent/sizing/vbox/... -> katex-*); markup and katex.min.css come from the same resolved package so they stay in sync, and Apollo only targets the unchanged root `.katex`. Pinned exact: 0.18.11 is deprecated upstream ("accidentally published with breaking changes", = 0.19.0) (it shipped 0.19.0's breaking `strict` change for missing character metrics); ^0.18.10 would resolve to it. Our renderers use output: 'mathml', which does no metric lookups, so behavior matches 0.16 either way. 0.18.10 vetted 2026-10-16: aged past quarantine (2026-09-30), release notes 0.18.3-0.18.10 fixes/features only ✓, no new deps beyond commander ✓ # Advisories with no installable fix — FIXME: remove each entry once a patched version is reachable auditConfig: ignoreGhsas: - GHSA-vfj7-8cjw-p6xm # braces <=3.0.3 (high, deeply nested pattern stack exhaustion) — no patched release exists (3.0.3 is latest, advisory lists no fix) as of 2026-10-09; via micromatch/chokidar - - GHSA-238p-pmpm-9mq7 # katex <0.18.2 (low, prototype pollution bypasses trust) — fix only on 0.18.x, which renames KaTeX's CSS classes; mermaid (incl. 12.x), nextra, rehype-katex, micromark-extension-math all pin ^0.16 as of 2026-10-09 # packageExtensions (moved from package.json#pnpm for the same reason) packageExtensions: