Repository navigation
chore(deps): bump katex from 0.16.47 to 0.18.2 - #1110
Open
dependabot[bot] wants to merge 1 commit into
Open
dependabot[bot] wants to merge 1 commit into
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
Contributor
|
Important Review skippedBot user detected. To trigger a single review, invoke the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
Code Review by Qodo
1. Rendered math still uses an older release
|
![qodo-code-review[bot]](https://avatars.githubusercontent.com/in/484649?s=60&v=4){kind=small}
Comment on lines
+12356
to
+12357
| "node_modules/rehype-katex/node_modules/katex": { | ||
| "version": "0.16.47", |
Contributor
There was a problem hiding this comment.
1. Rendered math still uses an older release 🐞 Bug ≡ Correctness
The lockfile installs katex@0.16.47 under rehype-katex because that plugin requires `katex: ^0.16.0 rather than the new root 0.18.2` release. Every math expression rendered through the Markdown plugin therefore uses the nested version, so the fixes in 0.18.2 do not reach that rendering path.
Agent Prompt
## Issue description
The dependency bump installs KaTeX 0.18.2 at the root, but the Markdown math renderer still uses its nested KaTeX 0.16.47 dependency.
## Fix Focus Areas
- package.json[51-51]
- package.json[77-77]
- package-lock.json[12338-12357]
- src/components/MarkdownRender/markdown.jsx[179-184]
## Recommended Fix
Upgrade the Markdown math renderer to a version that supports KaTeX 0.18.2, regenerate the lockfile, and verify that the renderer resolves to the intended version. Check its rendered output against the bundled KaTeX stylesheet after the upgrade.
ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools
Contributor
There was a problem hiding this comment.
Copilot review overview
🟡 Changes recommended
The active rehype-katex renderer still resolves vulnerable KaTeX 0.16.47 copies.
Review effort: Balanced
Findings: None
What changed in this PR
Updates the direct KaTeX dependency to 0.18.2.
Changes:
- Bumps KaTeX from 0.16.x to 0.18.2.
- Regenerates dependency resolution metadata.
| File | Description |
|---|---|
package.json |
Updates the KaTeX dependency range. |
package-lock.json |
Locks KaTeX versions and integrity metadata. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Bumps [katex](https://github.com/KaTeX/KaTeX) from 0.16.47 to 0.18.2. - [Release notes](https://github.com/KaTeX/KaTeX/releases) - [Changelog](https://github.com/KaTeX/KaTeX/blob/main/CHANGELOG.md) - [Commits](KaTeX/KaTeX@v0.16.47...v0.18.2) --- updated-dependencies: - dependency-name: katex dependency-version: 0.18.2 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
changed the title
dependabot
Bot
force-pushed
the
dependabot/npm_and_yarn/katex-0.18.2
branch
from
October 7, 2026 19:20
0aebdf1 to
e4c2d7a
Compare
Member
|
/agentic_review |
Contributor
|
Code review by qodo was updated up to the latest commit e4c2d7a |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps katex from 0.16.47 to 0.18.2.
Release notes
Sourced from katex's releases.
Changelog
Sourced from katex's changelog.
Commits
93c362bchore(release): 0.18.2 [ci skip]0adf7e7fix: prevent prototype pollution in settings (#4260)5a5bf20chore(deps): update dependency postcss to v8.5.23 [security] (#4259)3134908chore(deps): bump github/codeql-action from 4 to 4.37.4 (#4258)69edd93chore(deps): update dependency js-yaml to v4.3.0 [security] (#4253)b300885chore(deps): update dependency postcss to v8.5.18 [security] (#4252)42d2249chore(deps): update dependency webpack-dev-server to v5.2.6 [security] (#4251)afbf97dchore(deps): bump actions/setup-node from 6 to 7 (#4247)cdf479fchore(release): 0.18.1 [ci skip]87a2b30fix(htmlData): allow escaped commas in \htmlData (#4236)Install script changes
This version adds
preparescript that runs during installation. Review the package contents before updating.