From 0c1dc388317afa17cfc3d6fa3e392b0092b61c4a Mon Sep 17 00:00:00 2001 From: Cristian Calina Date: Thu, 15 Oct 2026 22:06:15 -0700 Subject: [PATCH 1/2] fix(apollo-react): bump katex to 0.18.11 to fix CVE-2026-103923 [PLT-97228] katex <0.18.2 is vulnerable to prototype pollution in settings that bypasses `trust` (GHSA-238p-pmpm-9mq7). The fix only exists on the 0.18 line, and mermaid, rehype-katex and micromark-extension-math still pin ^0.16, so bump apollo-react's direct dependency and add a workspace override to force every copy onto 0.18.11. The advisory is removed from auditConfig.ignoreGhsas now that a fix is installed. 0.18.0 prefixes KaTeX's generic CSS classes (accent, sizing, vbox, ... -> katex-*). The ap-chat markdown imports katex/dist/katex.min.css from the same resolved package as the renderer, so markup and styles stay in sync, and Apollo only styles the unchanged root `.katex` class. 0.18.11 is past the 14-day minimumReleaseAge, so no exemption is needed. Co-Authored-By: Claude Opus 5.5 --- packages/apollo-react/package.json | 2 +- pnpm-lock.yaml | 46 +++++++++++++----------------- pnpm-workspace.yaml | 2 +- 3 files changed, 22 insertions(+), 28 deletions(-) diff --git a/packages/apollo-react/package.json b/packages/apollo-react/package.json index 5117b7300..16052038b 100644 --- a/packages/apollo-react/package.json +++ b/packages/apollo-react/package.json @@ -241,7 +241,7 @@ "date-fns": "^4.1.0", "debounce": "^3.0.0", "html-to-image": "^1.11.11", - "katex": "^0.16.27", + "katex": "^0.18.11", "lexical": "0.42.0", "lodash": "^4.18.1", "lucide-react": "^0.577.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index e63c6d77c..2159f6e3d 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -35,6 +35,7 @@ overrides: svgo@>=3.0.0 <4: ^3.3.5 svgo@>=4.0.0: ^4.1.0 colord: 2.9.4 + katex: ^0.18.11 packageExtensionsChecksum: sha256-MiSYq8DXxufYD2Uu5iQfUDBUnmlvtj4LBvzJl3bvsgA= @@ -599,8 +600,8 @@ importers: specifier: ^1.11.11 version: 1.11.13 katex: - specifier: ^0.16.27 - version: 0.16.27 + specifier: ^0.18.11 + version: 0.18.11 lexical: specifier: 0.42.0 version: 0.42.0 @@ -7415,10 +7416,10 @@ packages: typescript: '*' '@uipath/core-telemetry@1.0.0-beta.3': - resolution: {integrity: sha512-e/IHHJ77tygw/LvFRSEQ/bxFlmTivrk0ApeRIsPqTpwxXNEryGxLzSjWCRflAKs3EYj+jiwEYRWINpodMjmrqw==} + resolution: {integrity: sha512-e/IHHJ77tygw/LvFRSEQ/bxFlmTivrk0ApeRIsPqTpwxXNEryGxLzSjWCRflAKs3EYj+jiwEYRWINpodMjmrqw==, tarball: https://npm.pkg.github.com/download/@uipath/core-telemetry/1.0.0-beta.3/32d88184e5f8256cae61eaef80fe79e581a9b134} '@uipath/uipath-typescript@1.8.0': - resolution: {integrity: sha512-KG11KsOzKNgLmFXtkIXpWPdg8egyhstNWbRQk42d7fM530BH28np4DodB6tcrsqJmPR9YBJyxkilmSxpvBHZeQ==} + resolution: {integrity: sha512-KG11KsOzKNgLmFXtkIXpWPdg8egyhstNWbRQk42d7fM530BH28np4DodB6tcrsqJmPR9YBJyxkilmSxpvBHZeQ==, tarball: https://npm.pkg.github.com/download/@uipath/uipath-typescript/1.8.0/7bf645acefa9ac4059a4dbf6fb8a4e14ffa6b5ea} peerDependencies: zod: ^4.2.1 @@ -8268,6 +8269,10 @@ packages: resolution: {integrity: sha512-TywoWNNRbhoD0BXs1P3ZEScW8W5iKrnbithIl0YH+uCmBd0QpPOA8yc82DS3BIE5Ma6FnBVUsJ7wVUDz4dvOWQ==} engines: {node: '>=20'} + commander@15.0.0: + resolution: {integrity: sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==} + engines: {node: '>=22.12.0'} + commander@2.20.3: resolution: {integrity: sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==} @@ -8279,10 +8284,6 @@ packages: resolution: {integrity: sha512-QrWXB+ZQSVPmIWIhtEO9H+gwHaMGYiF5ChvoJ+K9ZGHG/sVsa6yiesAD1GC/x46sET00Xlwo1u49RVVVzvcSkw==} engines: {node: '>= 10'} - commander@8.3.0: - resolution: {integrity: sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==} - engines: {node: '>= 12'} - commitizen@4.3.1: resolution: {integrity: sha512-gwAPAVTy/j5YcOOebcCRIijn+mSjWJC+IYKivTu6aG8Ei/scoXgfsMRnuAk6b0GRste2J4NGxVdMN3ZpfNaVaw==} engines: {node: '>= 12'} @@ -10588,12 +10589,9 @@ packages: resolution: {integrity: sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==} engines: {node: '>=18'} - katex@0.16.27: - resolution: {integrity: sha512-aeQoDkuRWSqQN6nSvVCEFvfXdqo1OQiCmmW1kc9xSdjutPv7BGO7pqY9sQRJpMOGrEdfDgF2TfRXe5eUAD2Waw==} - hasBin: true - - katex@0.16.45: - resolution: {integrity: sha512-pQpZbdBu7wCTmQUh7ufPmLr0pFoObnGUoL/yhtwJDgmmQpbkg/0HSVti25Fu4rmd1oCR6NGWe9vqTWuWv3GcNA==} + katex@0.18.11: + resolution: {integrity: sha512-yvyz/2VMKqoho/35Hat5w37wIEdWJ5ElVMidTAlWrxr5uW4aBGsEpveTmKh18/zw08v/7lGswCPon4OhqmqrTA==} + deprecated: Accidentally published with breaking changes. Use 0.19.0 instead. hasBin: true keyv@4.5.4: @@ -21366,14 +21364,14 @@ snapshots: commander@14.0.2: {} + commander@15.0.0: {} + commander@2.20.3: {} commander@4.1.1: {} commander@7.2.0: {} - commander@8.3.0: {} - commitizen@4.3.1(@types/node@24.10.1)(typescript@5.9.3): dependencies: cachedir: 2.3.0 @@ -24030,13 +24028,9 @@ snapshots: jwt-decode@4.0.0: {} - katex@0.16.27: - dependencies: - commander: 8.3.0 - - katex@0.16.45: + katex@0.18.11: dependencies: - commander: 8.3.0 + commander: 15.0.0 keyv@4.5.4: dependencies: @@ -24629,7 +24623,7 @@ snapshots: dayjs: 1.11.20 dompurify: 3.4.16 es-toolkit: 1.46.1 - katex: 0.16.45 + katex: 0.18.11 khroma: 2.1.0 marked: 16.4.2 roughjs: 4.6.6 @@ -24727,7 +24721,7 @@ snapshots: dependencies: '@types/katex': 0.16.7 devlop: 1.1.0 - katex: 0.16.27 + katex: 0.18.11 micromark-factory-space: 2.0.1 micromark-util-character: 2.1.1 micromark-util-symbol: 2.0.1 @@ -25099,7 +25093,7 @@ snapshots: fast-glob: 3.3.3 github-slugger: 2.0.0 hast-util-to-estree: 3.1.3 - katex: 0.16.27 + katex: 0.18.11 mdast-util-from-markdown: 2.0.2 mdast-util-gfm: 3.1.0 mdast-util-to-hast: 13.2.1 @@ -26534,7 +26528,7 @@ snapshots: '@types/katex': 0.16.7 hast-util-from-html-isomorphic: 2.0.0 hast-util-to-text: 4.0.2 - katex: 0.16.27 + katex: 0.18.11 unist-util-visit-parents: 6.0.2 vfile: 6.0.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index ec2e7c881..73953adc7 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -67,11 +67,11 @@ overrides: "svgo@>=3.0.0 <4": "^3.3.5" # GHSA-w27v-7q3p-w38r (high, removeScripts namespace/control-char bypass) + GHSA-4vpr-x523-8j87 (moderate, foreignObject sanitization) — v3 backport; transitive via @svgr/webpack>@svgr/plugin-svgo (^3.0.2) "svgo@>=4.0.0": "^4.1.0" # same two advisories on the v4 line (no 4.0.x patch) — transitive via cssnano>postcss-svgo (^4.0.0); 4.1.0 also bumps sax 1.6.1 / css-what ^7 / css-select ^6 (all long-aged, maintainers unchanged) colord: "2.9.4" # GHSA-2wm5-q62r-hmrv (moderate, quadratic backtracking rejecting oversized malformed color strings) — transitive via cssnano>postcss-colormin (^2.9.3) and stylelint (^2.9.3). Pinned exact: ^2.9.4 would reach 2.10.0 (feature release, unvetted). No npm provenance on any colord release (classic token publish); publisher omgovich unchanged since 2021 and fix commit 8701808 "reject malformed color strings in linear time" (#141) matches the advisory + katex: "^0.18.11" # GHSA-238p-pmpm-9mq7 / CVE-2026-103923 (low, prototype pollution in settings bypasses `trust`; patched 0.18.2) — mermaid, rehype-katex, micromark-extension-math, nextra all still pin ^0.16, so force the 0.18 line. 0.18.0 prefixes KaTeX's generic CSS classes (accent/sizing/vbox/... -> katex-*); markup and katex.min.css come from the same resolved package so they stay in sync, and Apollo only targets the unchanged root `.katex`. 0.18.11 vetted 2026-10-16: aged past quarantine (2026-10-01), tag v0.18.11 + release notes 0.18.3-0.18.11 (fixes/features only) ✓, no new deps beyond commander ✓ # Advisories with no installable fix — FIXME: remove each entry once a patched version is reachable auditConfig: ignoreGhsas: - GHSA-vfj7-8cjw-p6xm # braces <=3.0.3 (high, deeply nested pattern stack exhaustion) — no patched release exists (3.0.3 is latest, advisory lists no fix) as of 2026-10-09; via micromatch/chokidar - - GHSA-238p-pmpm-9mq7 # katex <0.18.2 (low, prototype pollution bypasses trust) — fix only on 0.18.x, which renames KaTeX's CSS classes; mermaid (incl. 12.x), nextra, rehype-katex, micromark-extension-math all pin ^0.16 as of 2026-10-09 # packageExtensions (moved from package.json#pnpm for the same reason) packageExtensions: From ca5dad0dcd8677b96343b59ae5042a14df11e4c0 Mon Sep 17 00:00:00 2001 From: Cristian Calina Date: Thu, 15 Oct 2026 22:19:34 -0700 Subject: [PATCH 2/2] fix(apollo-react): pin katex 0.18.10 and drop GitHub registry tarball urls [PLT-97228] katex 0.18.11 is deprecated upstream ("accidentally published with breaking changes", re-released as 0.19.0), so pin the last good 0.18.x exactly; a caret range would still resolve to 0.18.11. 0.18.10 carries the GHSA-238p-pmpm-9mq7 fix (>=0.18.2) and is past minimumReleaseAge. The previous lockfile was generated with a user-level npmrc mapping @uipath to GitHub Packages, which wrote npm.pkg.github.com tarball urls for @uipath/core-telemetry and @uipath/uipath-typescript. CI installs @uipath packages from npmjs.org without a token, so every job failed with ERR_PNPM_FETCH_401. Those entries are restored to plain npm resolutions. Co-Authored-By: Claude Opus 5.5 --- packages/apollo-react/package.json | 2 +- pnpm-lock.yaml | 25 ++++++++++++------------- pnpm-workspace.yaml | 2 +- 3 files changed, 14 insertions(+), 15 deletions(-) diff --git a/packages/apollo-react/package.json b/packages/apollo-react/package.json index 16052038b..8c62320ff 100644 --- a/packages/apollo-react/package.json +++ b/packages/apollo-react/package.json @@ -241,7 +241,7 @@ "date-fns": "^4.1.0", "debounce": "^3.0.0", "html-to-image": "^1.11.11", - "katex": "^0.18.11", + "katex": "0.18.10", "lexical": "0.42.0", "lodash": "^4.18.1", "lucide-react": "^0.577.0", diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml index 2159f6e3d..bdd8102b4 100644 --- a/pnpm-lock.yaml +++ b/pnpm-lock.yaml @@ -35,7 +35,7 @@ overrides: svgo@>=3.0.0 <4: ^3.3.5 svgo@>=4.0.0: ^4.1.0 colord: 2.9.4 - katex: ^0.18.11 + katex: 0.18.10 packageExtensionsChecksum: sha256-MiSYq8DXxufYD2Uu5iQfUDBUnmlvtj4LBvzJl3bvsgA= @@ -600,8 +600,8 @@ importers: specifier: ^1.11.11 version: 1.11.13 katex: - specifier: ^0.18.11 - version: 0.18.11 + specifier: 0.18.10 + version: 0.18.10 lexical: specifier: 0.42.0 version: 0.42.0 @@ -7416,10 +7416,10 @@ packages: typescript: '*' '@uipath/core-telemetry@1.0.0-beta.3': - resolution: {integrity: sha512-e/IHHJ77tygw/LvFRSEQ/bxFlmTivrk0ApeRIsPqTpwxXNEryGxLzSjWCRflAKs3EYj+jiwEYRWINpodMjmrqw==, tarball: https://npm.pkg.github.com/download/@uipath/core-telemetry/1.0.0-beta.3/32d88184e5f8256cae61eaef80fe79e581a9b134} + resolution: {integrity: sha512-e/IHHJ77tygw/LvFRSEQ/bxFlmTivrk0ApeRIsPqTpwxXNEryGxLzSjWCRflAKs3EYj+jiwEYRWINpodMjmrqw==} '@uipath/uipath-typescript@1.8.0': - resolution: {integrity: sha512-KG11KsOzKNgLmFXtkIXpWPdg8egyhstNWbRQk42d7fM530BH28np4DodB6tcrsqJmPR9YBJyxkilmSxpvBHZeQ==, tarball: https://npm.pkg.github.com/download/@uipath/uipath-typescript/1.8.0/7bf645acefa9ac4059a4dbf6fb8a4e14ffa6b5ea} + resolution: {integrity: sha512-KG11KsOzKNgLmFXtkIXpWPdg8egyhstNWbRQk42d7fM530BH28np4DodB6tcrsqJmPR9YBJyxkilmSxpvBHZeQ==} peerDependencies: zod: ^4.2.1 @@ -10589,9 +10589,8 @@ packages: resolution: {integrity: sha512-+KJGIyHgkGuIq3IEBNftfhW/LfWhXUIY6OmyVWjliu5KH1y0fw7VQ8YndE2O4qZdMSd9SqbnC8GOcZEy0Om7sA==} engines: {node: '>=18'} - katex@0.18.11: - resolution: {integrity: sha512-yvyz/2VMKqoho/35Hat5w37wIEdWJ5ElVMidTAlWrxr5uW4aBGsEpveTmKh18/zw08v/7lGswCPon4OhqmqrTA==} - deprecated: Accidentally published with breaking changes. Use 0.19.0 instead. + katex@0.18.10: + resolution: {integrity: sha512-/B6p9eY9DX7aHBfpkHdpirDTZ5QH9xTwL9y837PWuzuv41O5jFdqNQwVQEQsimY0/iVNkwBY4+4hMfhQ7d4Dbw==} hasBin: true keyv@4.5.4: @@ -24028,7 +24027,7 @@ snapshots: jwt-decode@4.0.0: {} - katex@0.18.11: + katex@0.18.10: dependencies: commander: 15.0.0 @@ -24623,7 +24622,7 @@ snapshots: dayjs: 1.11.20 dompurify: 3.4.16 es-toolkit: 1.46.1 - katex: 0.18.11 + katex: 0.18.10 khroma: 2.1.0 marked: 16.4.2 roughjs: 4.6.6 @@ -24721,7 +24720,7 @@ snapshots: dependencies: '@types/katex': 0.16.7 devlop: 1.1.0 - katex: 0.18.11 + katex: 0.18.10 micromark-factory-space: 2.0.1 micromark-util-character: 2.1.1 micromark-util-symbol: 2.0.1 @@ -25093,7 +25092,7 @@ snapshots: fast-glob: 3.3.3 github-slugger: 2.0.0 hast-util-to-estree: 3.1.3 - katex: 0.18.11 + katex: 0.18.10 mdast-util-from-markdown: 2.0.2 mdast-util-gfm: 3.1.0 mdast-util-to-hast: 13.2.1 @@ -26528,7 +26527,7 @@ snapshots: '@types/katex': 0.16.7 hast-util-from-html-isomorphic: 2.0.0 hast-util-to-text: 4.0.2 - katex: 0.18.11 + katex: 0.18.10 unist-util-visit-parents: 6.0.2 vfile: 6.0.3 diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 73953adc7..51189a79c 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -67,7 +67,7 @@ overrides: "svgo@>=3.0.0 <4": "^3.3.5" # GHSA-w27v-7q3p-w38r (high, removeScripts namespace/control-char bypass) + GHSA-4vpr-x523-8j87 (moderate, foreignObject sanitization) — v3 backport; transitive via @svgr/webpack>@svgr/plugin-svgo (^3.0.2) "svgo@>=4.0.0": "^4.1.0" # same two advisories on the v4 line (no 4.0.x patch) — transitive via cssnano>postcss-svgo (^4.0.0); 4.1.0 also bumps sax 1.6.1 / css-what ^7 / css-select ^6 (all long-aged, maintainers unchanged) colord: "2.9.4" # GHSA-2wm5-q62r-hmrv (moderate, quadratic backtracking rejecting oversized malformed color strings) — transitive via cssnano>postcss-colormin (^2.9.3) and stylelint (^2.9.3). Pinned exact: ^2.9.4 would reach 2.10.0 (feature release, unvetted). No npm provenance on any colord release (classic token publish); publisher omgovich unchanged since 2021 and fix commit 8701808 "reject malformed color strings in linear time" (#141) matches the advisory - katex: "^0.18.11" # GHSA-238p-pmpm-9mq7 / CVE-2026-103923 (low, prototype pollution in settings bypasses `trust`; patched 0.18.2) — mermaid, rehype-katex, micromark-extension-math, nextra all still pin ^0.16, so force the 0.18 line. 0.18.0 prefixes KaTeX's generic CSS classes (accent/sizing/vbox/... -> katex-*); markup and katex.min.css come from the same resolved package so they stay in sync, and Apollo only targets the unchanged root `.katex`. 0.18.11 vetted 2026-10-16: aged past quarantine (2026-10-01), tag v0.18.11 + release notes 0.18.3-0.18.11 (fixes/features only) ✓, no new deps beyond commander ✓ + katex: "0.18.10" # GHSA-238p-pmpm-9mq7 / CVE-2026-103923 (low, prototype pollution in settings bypasses `trust`; patched 0.18.2) — mermaid, rehype-katex, micromark-extension-math, nextra all still pin ^0.16, so force the 0.18 line. 0.18.0 prefixes KaTeX's generic CSS classes (accent/sizing/vbox/... -> katex-*); markup and katex.min.css come from the same resolved package so they stay in sync, and Apollo only targets the unchanged root `.katex`. Pinned exact: 0.18.11 is deprecated upstream ("accidentally published with breaking changes", = 0.19.0) (it shipped 0.19.0's breaking `strict` change for missing character metrics); ^0.18.10 would resolve to it. Our renderers use output: 'mathml', which does no metric lookups, so behavior matches 0.16 either way. 0.18.10 vetted 2026-10-16: aged past quarantine (2026-09-30), release notes 0.18.3-0.18.10 fixes/features only ✓, no new deps beyond commander ✓ # Advisories with no installable fix — FIXME: remove each entry once a patched version is reachable auditConfig: ignoreGhsas: