Repository navigation
fix: Override vulnerable minimatch and katex in lint tooling - #62
Merged
Merged
Conversation
Clear two Dependabot alerts on development-only lint tooling. minimatch 10.2.6 (GHSA-g3hv-75wg-m249) comes in through eslint and typescript-eslint; katex 0.16.47 (GHSA-238p-pmpm-9mq7) comes in through markdownlint-cli2. Their direct parents have not released versions that move to the fixed ranges, so npm overrides pin the patched releases. Key changes: - Override minimatch to ^11.0.5; eslint, @eslint/config-array and typescript-eslint use no API that v11 removed - Override katex to ^0.18.2 under micromark-extension-math only; markdownlint never loads katex, since only the HTML renderer imports it - Lock also moves katex's commander dependency to 15.1.0 and adds minimatch's @isaacs/nonrecursive-glob-match; nothing else changes The production image installs with --omit=dev, so neither package ships.
ecv
marked this pull request as ready for review
November 10, 2026 14:09
Contributor
Author
|
Review loop. Adversary: ship. Lint checks the same 5 files with the same results before and after. The global minimatch override moves only consumers that were already on a 10.x range. Neither package is in the production install. Conventions: ship. A merge redeploys the static site to GitHub Pages, and no image or infra pin moves. Land this before #46 and #48, which already conflict and add their own overrides block, so whichever of them lands next needs its lock regenerated. |
andrewb3000
approved these changes
Nov 10, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two Dependabot alerts flag minimatch (https://github.com/datum-cloud/cloudvalid.com/security/dependabot/105) and katex (https://github.com/datum-cloud/cloudvalid.com/security/dependabot/78). Both come in only through the lint tools, so the site never ships them. npm overrides now force minimatch 11.0.5 and katex 0.18.10, and that clears both alerts.
What changes
eslint, typescript-eslint and markdownlint-cli2 have not moved to the fixed versions yet, so the overrides do it for them. The lock file also picks up katex's newer command-line dependency and one helper package for minimatch. Nothing else in the tree moves.
The linters use no feature the new versions removed. markdownlint never loads katex at all.
Test plan
npm ci,npm run lintandnpm run buildpassnpm ls minimatch katexshows only the patched versions, andnpm auditfinds 0 vulnerabilities