From 3f79bdb7a577540f39340724ed124617f6d6c868 Mon Sep 17 00:00:00 2001 From: Robert Allen Date: Thu, 8 Oct 2026 18:07:08 -0400 Subject: [PATCH] fix(deps): force patched katex and postcss-selector-parser via overrides Replace two osv-scanner waivers with real fixes by forcing the patched releases through npm `overrides`: - katex ^0.18.2 (GHSA-238p-pmpm-9mq7; held back by mermaid's ^0.16) -> 0.18.10 - postcss-selector-parser ^7.1.6 (GHSA-rj75-hqrm-r3gf; held back by postcss-nested ^6 via expressive-code) -> 7.1.6 The braces waiver (GHSA-vfj7-8cjw-p6xm) stays: no fixed release exists. Co-Authored-By: Claude Opus 5.5 --- osv-scanner.toml | 25 +++---------------------- package-lock.json | 22 +++++++++++----------- package.json | 4 +++- 3 files changed, 17 insertions(+), 34 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 3a193e1..00e5272 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -6,6 +6,9 @@ # the upstream dependency ranges, and no untrusted input reaching the affected # code. Revisit on each release and on every dependency bump; remove an entry # as soon as the fix becomes resolvable. +# +# Advisories with a fixed release outside an upstream range (katex, +# postcss-selector-parser) are fixed via package.json `overrides`, not waived. [[IgnoredVulns]] id = "GHSA-vfj7-8cjw-p6xm" @@ -15,25 +18,3 @@ id = "GHSA-vfj7-8cjw-p6xm" # from this repo's own build config, never from user input; not part of the # deployed static site. Remove this entry once a fixed braces release ships. reason = "No fixed braces release exists; build-time-only transitive (starlight-llms-txt -> micromatch) matching repo-authored patterns, never untrusted input; no production exposure. Revisit when braces ships a fix." - -[[IgnoredVulns]] -id = "GHSA-238p-pmpm-9mq7" -# katex 0.16.47, CVSS 2.1 (low). Pulled in only by mermaid 11 (via -# astro-mermaid), which pins katex ^0.16; the fix is 0.18.2, outside that -# range. KaTeX is only a read-side gadget: exploiting it requires prototype -# pollution that already exists in the page. Mermaid only invokes KaTeX for -# math in diagram labels; this site's diagrams are repo-authored (one diagram, -# in docs/index.md) and contain no math, and no untrusted input reaches them. -# Remove this entry once mermaid accepts katex >= 0.18.2. -reason = "Low-severity katex advisory requiring pre-existing prototype pollution; only reachable through mermaid, which pins katex ^0.16 (fix is 0.18.2). Diagrams are repo-authored with no math; no untrusted input reaches KaTeX. Revisit when mermaid bumps katex." - -[[IgnoredVulns]] -id = "GHSA-rj75-hqrm-r3gf" -# postcss-selector-parser 6.1.4: quadratic-time parsing of very long flat -# selectors (CPU exhaustion). Fixed only in 7.1.6, but the sole consumer is -# postcss-nested 6.2.0 (requires ^6.1.1), pinned via @astrojs/starlight -> -# expressive-code -> @expressive-code/core (postcss-nested ^6.0.1). Build-time -# only: it parses the repo's own code-block theme CSS while `astro build` -# runs, never untrusted input, and is not shipped in the deployed static site. -# Remove this entry once expressive-code moves to postcss-nested >= 7. -reason = "Fix (7.1.6) is outside postcss-nested 6.x's ^6.1.1 range, pinned by Starlight's expressive-code; build-time-only parsing of repo-authored CSS, never untrusted input; no production exposure. Revisit when expressive-code bumps postcss-nested." diff --git a/package-lock.json b/package-lock.json index f41ef0f..911c625 100644 --- a/package-lock.json +++ b/package-lock.json @@ -4779,9 +4779,9 @@ "license": "MIT" }, "node_modules/katex": { - "version": "0.16.47", - "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz", - "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==", + "version": "0.18.10", + "resolved": "https://registry.npmjs.org/katex/-/katex-0.18.10.tgz", + "integrity": "sha512-/B6p9eY9DX7aHBfpkHdpirDTZ5QH9xTwL9y837PWuzuv41O5jFdqNQwVQEQsimY0/iVNkwBY4+4hMfhQ7d4Dbw==", "funding": [ "https://opencollective.com/katex", "https://github.com/sponsors/katex" @@ -4789,20 +4789,20 @@ "license": "MIT", "peer": true, "dependencies": { - "commander": "^8.3.0" + "commander": "^15.0.0" }, "bin": { "katex": "cli.js" } }, "node_modules/katex/node_modules/commander": { - "version": "8.3.0", - "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz", - "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==", + "version": "15.0.0", + "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz", + "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==", "license": "MIT", "peer": true, "engines": { - "node": ">= 12" + "node": ">=22.12.0" } }, "node_modules/khroma": { @@ -6391,9 +6391,9 @@ } }, "node_modules/postcss-selector-parser": { - "version": "6.1.4", - "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.4.tgz", - "integrity": "sha512-bIoJLOmjCO1S9XdY/DcnR5hJxvrDir1PbGChrzXG3vw0/FOliy/fA3dmdhQ441kah4gKv+TwckGzex6wNS5cnQ==", + "version": "7.1.6", + "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-7.1.6.tgz", + "integrity": "sha512-7qASPzhKF2l2KLboRZux8CCTRMdGiV08vWmyKzPz22qZ7ZjQBOeY7rNzNoCLSUiftJ7HUq0GERHmxw/t0dCdMw==", "license": "MIT", "dependencies": { "cssesc": "^3.0.0", diff --git a/package.json b/package.json index a0eb8b1..4e848e1 100644 --- a/package.json +++ b/package.json @@ -14,7 +14,9 @@ "astro-mermaid": "2.1.0" }, "overrides": { - "esbuild": "0.28.1" + "esbuild": "0.28.1", + "katex": "^0.18.2", + "postcss-selector-parser": "^7.1.6" }, "allowScripts": { "esbuild@0.28.1": true