From c75736f3ae0ef5c973994165a45930ab1edb53f4 Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Tue, 10 Nov 2026 07:22:41 -0500
Subject: [PATCH] fix(deps): patch vulnerable re2js and selector parser

The lint and Tailwind toolchains pinned re2js 2.8.6 and
postcss-selector-parser 6.0.10, both open to CPU-exhaustion denial of
service (GHSA-gg6h-894w-4m9c, GHSA-rj75-hqrm-r3gf). Their parents pin
exact versions, so an in-range refresh cannot move them.

Key changes:
- Override re2js to 2.8.7 under markdownlint only
- Override postcss-selector-parser to 6.1.5 under @tailwindcss/typography
  only, staying in the 6.x major it expects

minimatch and katex stay open: their fixes need a major (minimatch 11,
katex 0.18) that no released parent accepts yet.
---
 package-lock.json | 14 +++++++-------
 package.json      |  8 ++++++++
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 97d3c54..d919711 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6870,9 +6870,9 @@
       }
     },
     "node_modules/postcss-selector-parser": {
-      "version": "6.0.10",
-      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.0.10.tgz",
-      "integrity": "sha512-IQ7TZdoaqbT+LCpShg46jnZVlhWD2w6iQYAcYXfHARZ7X1t/UGhhceQDs5X0cGqKvYlHNOuv7Oa1xmb0oQuA3w==",
+      "version": "6.1.5",
+      "resolved": "https://registry.npmjs.org/postcss-selector-parser/-/postcss-selector-parser-6.1.5.tgz",
+      "integrity": "sha512-TEHFzb5KRDKaOgJ4TYE+0jyJtFbjLvkdVOu0fZ2b6MTWzoqZd4Le+61aEppWkvTlYePgOX4ATL1wsAIPMLTw6Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -7033,13 +7033,13 @@
       }
     },
     "node_modules/re2js": {
-      "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/re2js/-/re2js-2.8.6.tgz",
-      "integrity": "sha512-xLgQil4kIUCrAzVk9fRSkxkFNwmygLFjVxXrLc65aE1F0+Zsb8rxumFBy4XKyvgMCTL6kilDq3EZ0piE2dP/Dg==",
+      "version": "2.8.7",
+      "resolved": "https://registry.npmjs.org/re2js/-/re2js-2.8.7.tgz",
+      "integrity": "sha512-bRSL/vn3KAmlGfGNoVpcsBXLaVvl6AbuvMMWbz0m3vBj60nj+p2/biozfBUOSBP+5XTduF6mr6IO/ZVjmqqkVQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/readdirp": {
diff --git a/package.json b/package.json
index 5c3bf5e..bd4b251 100644
--- a/package.json
+++ b/package.json
@@ -51,5 +51,13 @@
     "*.{json,css,scss}": [
       "prettier --write"
     ]
+  },
+  "overrides": {
+    "markdownlint": {
+      "re2js": "2.8.7"
+    },
+    "@tailwindcss/typography": {
+      "postcss-selector-parser": "6.1.5"
+    }
   }
 }