Repository navigation
fix(deps): clear npm audit for source-map-js and mermaid's katex - #960
Merged
Merged
Conversation
source-map-js 1.2.1 has a high advisory (GHSA-68fv-2mgg-jv7q); the lockfile moves to 1.2.2. mermaid requires katex ^0.16.47, and the KaTeX advisory (GHSA-238p-pmpm-9mq7) is fixed only from 0.18.2, so an override points mermaid at the katex 0.18.9 Markpad already depends on.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
npm auditfails on master with two new advisories, so every PR's test job is red (seen on #959).Mechanism
mermaid 11 (and 12.1.0, the latest) declares
katex ^0.16.47, and the fix exists only from 0.18.2, with no patched 0.16 release. No version satisfies both, sonpm audit fixleaves it and--forcewould downgrade mermaid to 10.8.0. An override points mermaid at$katex, the 0.18.9 Markpad already depends on, so there is one copy instead of two.mermaid calls a single katex function,
renderToString(tex, { throwOnError, displayMode, output }), which 0.18 keeps.Scope
Math in mermaid labels does not render in Markpad today, with or without this change:
htmlLabels: falsedraws flowchart labels as SVG text, so$$…$$shows as written, and a sequence diagram's math message comes out blank. Left alone here.Verification
macOS 27.0.1.
npm audit: 0 vulnerabilities.npm ls katex: mermaid's copy is deduped to 0.18.9.npm run check0 errors,npm test1112 pass,npx vitest run492 pass. In release builds before and after, a flowchart and a sequence diagram with$$…$$labels render the same.