[PeterDaveHello]

Apply the lockfile updates from npm audit fix, including compatible dependency updates and transitive package deduplication.

Defer the KaTeX upgrade because the extension maintains a custom stylesheet that needs accompanying changes and separate formula layout validation. This PR keeps KaTeX at 0.16.21 and does not claim to resolve all audit findings.

Validation:

• npm ci --offline --no-audit --no-fund
• npm test: 1,099 tests passed
• npm run pretty:check and npm run lint
• Production build with BUILD_PARALLEL=0 BUILD_THREAD=0; required artifacts verified for all four variants
• Pre-commit formatting and lint checks passed

Manual browser extension smoke testing was not completed because no graphical display session was available. External automated review was incomplete: CodeRabbit failed to connect, and the additional reviewer had not returned a result.

[Copilot]

Copilot wasn't able to review any files in this pull request. Check if the Files changed in this pull request are included in default exclusions.

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 884fdfdd-47f7-4b53-8761-2ca84d6159fd

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[qodo-code-review]

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0)

Great, no issues found!

Qodo reviewed your code and found no material issues that require review

Tip of the day

💡 Did you know, you can route each severity your way: inline, summary, both, or drop

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[qodo-code-review]

PR Summary by Qodo

Refresh audited dependencies while retaining KaTeX 0.16.21

⚙️ Configuration changes 🕐 10-20 Minutes

AI Description

• Refresh compatible transitive dependencies and deduplicate packages in the npm lockfile.
• Keep KaTeX at 0.16.21 pending stylesheet changes and formula-layout validation.
• Preserve the existing dependency declarations; this does not resolve every audit finding.

Diagram

graph TD
  A["package.json"] --> B["package-lock.json"] --> C["npm ci"] --> D["Production build"] --> E["Extension variants"]
  B --> F["KaTeX 0.16.21"]
  F -->|"layout compatibility"| G["Custom stylesheet"]
  G --> D

Loading

High-Level Assessment

The following are alternative approaches to this PR:

1. Pin KaTeX in package.json

• ➕ Prevents a future lockfile regeneration from selecting a newer KaTeX version before styling is validated.
• ➖ Changes the declared dependency policy and requires a later manifest change to resume KaTeX upgrades.

2. Upgrade KaTeX and stylesheet together

• ➕ Could address additional audit findings in one dependency update.
• ➖ Expands this PR to formula-layout changes that need browser validation.

Recommendation: The lockfile-only refresh is appropriate for this scoped update. KaTeX's manifest range still permits newer 0.16.x releases, however, so pin it separately if the deferral must survive future lockfile regeneration.

Files changed (1) +76 / -267

Other (1) +76 / -267

package-lock.jsonRefresh transitive packages without upgrading KaTeX +76/-267

Refresh transitive packages without upgrading KaTeX

• Updates resolved packages including @parcel/watcher, fast-uri, picomatch, and PostCSS modules, and removes redundant nested packages. KaTeX remains at 0.16.21; package.json and application code are unchanged.

package-lock.json

[pullfrog]

✅ No new issues found.

Reviewed changes — lockfile-only dependency update; no source changed.

• Applies npm audit fix transitive updates in package-lock.json only, holding katex at 0.16.21 by design.
• Bumps @parcel/watcher 2.5.1 → 2.6.0 (swaps micromatch/detect-libc@^1 for picomatch@^4/detect-libc@^2, drops win32-ia32).
• Bumps and hoists picomatch 2.3.2 → 4.0.7 and postcss-selector-parser 6.1.4 → 7.1.6; removes the now-unused micromatch/braces/fill-range/to-regex-range/is-number subtree.
• Updates detect-libc 1.0.3 → 2.1.2, fast-uri 3.1.7 → 3.1.8, postcss-modules-local-by-default 4.0.5 → 4.2.0, postcss-modules-scope 3.2.0 → 3.2.1.

I verified the lockfile is internally consistent — every picomatch/postcss-selector-parser/detect-libc consumer range is satisfied by the single hoisted version, with no orphaned major-version requirement. I also confirmed @parcel/watcher@2.6.0, picomatch@4.0.7, and postcss-selector-parser@7.1.6 exist on the npm registry with integrity hashes exactly matching the lockfile, and that @parcel/watcher@2.6.0's declared dependencies/optionalDependencies match (including the dropped win32-ia32). The affected packages are dev/build-only, so there is no runtime surface.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[cubic-dev-ai]

No issues found across 1 file

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Tip: cubic could auto-approve low-risk PRs like this, if it thinks it's safe to merge. Learn more

View guided diff | Re-trigger cubic</sub>