fix(apollo-react): bump katex to 0.18.10 to fix CVE-2026-103923 [PLT-97228]

packages/apollo-react/package.json

@@ -241,7 +241,7 @@
     "date-fns": "^4.1.0",
     "debounce": "^3.0.0",
     "html-to-image": "^1.11.11",
-    "katex": "^0.16.27",
+    "katex": "0.18.10",
     "lexical": "0.42.0",
     "lodash": "^4.18.1",
     "lucide-react": "^0.577.0",

pnpm-workspace.yaml

@@ -67,11 +67,11 @@ overrides:
   "svgo@>=3.0.0 <4": "^3.3.5"           # GHSA-w27v-7q3p-w38r (high, removeScripts namespace/control-char bypass) + GHSA-4vpr-x523-8j87 (moderate, foreignObject sanitization) — v3 backport; transitive via @svgr/webpack>@svgr/plugin-svgo (^3.0.2)
   "svgo@>=4.0.0": "^4.1.0"              # same two advisories on the v4 line (no 4.0.x patch) — transitive via cssnano>postcss-svgo (^4.0.0); 4.1.0 also bumps sax 1.6.1 / css-what ^7 / css-select ^6 (all long-aged, maintainers unchanged)
   colord: "2.9.4"                       # GHSA-2wm5-q62r-hmrv (moderate, quadratic backtracking rejecting oversized malformed color strings) — transitive via cssnano>postcss-colormin (^2.9.3) and stylelint (^2.9.3). Pinned exact: ^2.9.4 would reach 2.10.0 (feature release, unvetted). No npm provenance on any colord release (classic token publish); publisher omgovich unchanged since 2021 and fix commit 8701808 "reject malformed color strings in linear time" (#141) matches the advisory
+  katex: "0.18.10"                     # GHSA-238p-pmpm-9mq7 / CVE-2026-103923 (low, prototype pollution in settings bypasses `trust`; patched 0.18.2) — mermaid, rehype-katex, micromark-extension-math, nextra all still pin ^0.16, so force the 0.18 line. 0.18.0 prefixes KaTeX's generic CSS classes (accent/sizing/vbox/... -> katex-*); markup and katex.min.css come from the same resolved package so they stay in sync, and Apollo only targets the unchanged root `.katex`. Pinned exact: 0.18.11 is deprecated upstream ("accidentally published with breaking changes", = 0.19.0) (it shipped 0.19.0's breaking `strict` change for missing character metrics); ^0.18.10 would resolve to it. Our renderers use output: 'mathml', which does no metric lookups, so behavior matches 0.16 either way. 0.18.10 vetted 2026-10-16: aged past quarantine (2026-09-30), release notes 0.18.3-0.18.10 fixes/features only ✓, no new deps beyond commander ✓
 # Advisories with no installable fix — FIXME: remove each entry once a patched version is reachable
 auditConfig:
   ignoreGhsas:
     - GHSA-vfj7-8cjw-p6xm   # braces <=3.0.3 (high, deeply nested pattern stack exhaustion) — no patched release exists (3.0.3 is latest, advisory lists no fix) as of 2026-10-09; via micromatch/chokidar
-    - GHSA-238p-pmpm-9mq7   # katex <0.18.2 (low, prototype pollution bypasses trust) — fix only on 0.18.x, which renames KaTeX's CSS classes; mermaid (incl. 12.x), nextra, rehype-katex, micromark-extension-math all pin ^0.16 as of 2026-10-09
 
 # packageExtensions (moved from package.json#pnpm for the same reason)
 packageExtensions: