Update: dependency updates (katex, lodash, ava 7, jsdom 29)

[Aetf]

The safe half of the dependency sweep. Everything here is verified and mergeable on its own; the Hexo 8 work is split out into a separate branch because it is blocked on an upstream release.

In-range updates (npm update)

hexo-cli                  4.3.1   -> 4.3.2
hexo-excerpt              1.3.0   -> 1.3.1
hexo-fs                   4.1.1   -> 4.1.3
hexo-renderer-markdown-it 7.1.0   -> 7.1.1
hexo-renderer-stylus      3.0.0   -> 3.0.1
katex                     0.16.8  -> 0.16.47
lodash                    4.17.21 -> 4.18.1

Snapshots were regenerated for the KaTeX bump. The complete set of content changes is numeric precision in inline styles — KaTeX now rounds to four decimals — plus one accent-placement fix:

margin-right:0.02778em -> 0.0278em
margin-right:0.03588em -> 0.0359em
margin-right:0.05017em -> 0.0502em
margin-right:0.07153em -> 0.0715em
margin-right:0.10764em -> 0.1076em
left:-0.1944em         -> -0.25em

No structural markup change. post.js.snap churns only its ava version stamp — the human-readable post.js.md companion is byte-identical.

Major bumps

• ava 5 -> 7, jsdom 22 -> 29. Both devDependencies only. ava 6 renamed ignoredByWatcher to watchMode.ignoreChanges and ava 7 hard-errors on the old key, so ava.config.mjs is updated. Node floors (^20.19) are satisfied by .nvmrc's 20 and by CI's node-version: latest.

43/43 tests pass; headless render of /, /blog, /about, /projects, /research and a post is clean with zero console errors.

Deliberately not updated

katex stays on ^0.16. 0.18.0's breaking change is "prefix css classes". The npm package only does the server-side render here — the matching stylesheet comes from cdnjs at whatever version NexT's _vendors.yml pins, currently 0.16.9. Bumping the package alone would emit prefixed class names against unprefixed CSS and render every equation as unstyled text, and custom/styles/math.styl's .katex selector would stop matching too. This can only move once NexT's vendored KaTeX does.

Split out of this PR

• Hexo 6 -> 8 is on chore/hexo-8. It works and is verified, but it is blocked on a hexo-next-publist release (Fix: support Hexo 7/8, and pin @primer/css back to ^17 hexo-next-publist#197) — the published 2.2.1 fails to load on Hexo 8, so CI would fail here.
• The muse.js entry in tools/link_check_skip.txt says "remove after next-theme/hexo-theme-next@0708dc7e is included in a release". We are now well past 8.24.0 and I could find no muse.js reference in the build, so it is plausibly dead — but I did not want to remove a link-check skip in a PR about dependency versions.

🤖 Generated with Claude Code