[VatsalSy]

Summary

Closes open Dependabot alerts on npm development dependencies in package-lock.json:

Alert	Package	Before	After	Method
#87 (high)	source-map-js	1.2.1	1.2.2	lockfile refresh (npm update; parents already allow ^1.2.1)
#86	postcss-selector-parser	7.1.4	7.1.6	lockfile refresh (npm update; stylelint allows ^7.1.0)
#81–#83	brace-expansion	1.1.18 / 2.1.4 / 5.0.9	1.1.21 / 2.1.7 / 5.0.12	tightened overrides
#89	smol-toml	1.7.2	1.9.1	override ~1.7.1 → ~1.9.1 (parent pins exact versions)
#88 (low)	katex	0.16.47	0.18.10	new override ~0.18.2 (micromark-extension-math still asks for ^0.16.0)

katex is only a transitive of markdownlint-cli2 → micromark-extension-math. It is not vendored under assets/ or loaded as a site runtime.

No unrelated major upgrades. Remaining npm audit findings (e.g. colord, fast-uri, picomatch-chain noise) are out of scope for this PR.

Follow-ups in this PR

• Restored optional linux libc metadata that npm had stripped from the lockfile (Copilot note).
• Rebased onto main after Update Verschuur PRF paper to full citation with figure and video #124 landed (dependency-only diff: package.json + package-lock.json).

Testing

• ./scripts/lint-check.sh — passed (3 pre-existing unused-var warnings)
• npm test -- --runInBand — 20 suites, 166 tests passed
• ./scripts/build.sh — Jekyll production build succeeded (Ruby 3.4.10 / Bundler 2.5.23)

Notes

• gh api .../dependabot/alerts returned 403 for the Cursor integration token; patched versions taken from npm audit / GHSA advisories matching the alert numbers above.

  

Summary by CodeRabbit

• Chores
  • Updated versions of supporting software packages used by the project. These are maintenance updates; no new user-facing features or changes to app functionality are described.
• Documentation
  • Adjusted spacing in the research index around a publication entry. The research and publication information remains unchanged; this is a formatting-only update.

[coderabbitai]

Important

Review skipped

Review was skipped as selected files did not have any reviewable changes.

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

---

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: 23164baf-3844-42ca-b7a9-aabc6487389a

---

📥 Commits

Reviewing files that changed from the base of the PR and between 62f8304 and a9116dc.

---

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

---

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Essentials
• Run ID: f1f632c6-4606-4344-a362-970a9f98f6ca

---

---

📥 Commits

Reviewing files that changed from the base of the PR and between 280c117 and 62f8304.

---

---

⛔ Files ignored due to path filters (1)

• package-lock.json is excluded by !**/package-lock.json

---

---

📒 Files selected for processing (1)

• _research/index.md

---

---

💤 Files with no reviewable changes (1)

• _research/index.md

---

---

Included review availability: This review used your included allowance. 2 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

---

📜 Recent review details

⏰ Context from checks skipped due to timeout. (2)

• GitHub Check: copilot-pull-request-reviewer
• GitHub Check: build

---

---

---

---

📝 Walkthrough

📝 Walkthrough

Walkthrough

The package.json overrides update version ranges for brace-expansion and smol-toml, and add overrides for brace-expansion and katex. The research index removes a blank line between an image and a publication entry.

Changes

Dependency overrides

Layer / File(s)	Summary
Update dependency override ranges package.json	The brace-expansion overrides are updated for ^1.0.0 and ^2.0.0, and an override is added for ^5.0.0. The smol-toml override changes from ~1.7.1 to ~1.9.1, and an override is added for katex.

Research index formatting

Layer / File(s)	Summary
Remove blank line _research/index.md	A blank line is removed between the Singularities in Soft Matter image and publication [25].

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~4 minutes

Change: Other

---

---

Merge Risk: ⚪ Minimal · up to 62f83

The dependency updates are reflected in the lockfile used by the repository’s install workflows. No actionable merge-blocking risk remains after normal checks.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly summarises the main change: updating transitive npm dependencies to address the specified Dependabot alerts. It is concise and specific.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

---

✨ Finishing Touches

✨ Simplify code

• Commit to this branch
• Create a new PR

---

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

🟡 Changes recommended

The lockfile refresh removes required libc platform metadata from native resolver bindings.

0 open findings

What changed in this PR

Updates transitive npm dependencies to remediate Dependabot alerts.

Changes:

• Pins patched dependency versions through npm overrides.
• Refreshes resolved versions and integrity hashes.

File	Description
package.json	Updates transitive dependency overrides.
package-lock.json	Records patched dependency resolutions.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

Overrides and lockfile resolutions are consistent, with no unresolved correctness issues.

0 open findings

🧠 Review effort: Balanced

[comphy-bot]

comphy-bot review status for comphy-lab/comphy-lab.github.io#134 at a9116dca: completed

Review completed for this exact pull request head.

[Copilot]

🟢 Approval recommended

The overrides and lockfile resolutions are consistent, valid, and compatible with the CI Node.js versions.

0 open findings

🧠 Review effort: Balanced

[comphy-bot]

Review: dependency security refresh

Reviewed a9116dcacb26ad6bc7b4d750bf82e33d1c728777 (+41/−39 across two files).

Findings

No verified P0/P1 findings in the supplied changes. The manifest overrides and corresponding lockfile version updates are consistent; the Linux native-binding libc selectors remain present. The earlier peer concern about removed platform metadata does not apply to this head.

Verification

• Inspected the manifest changes and dependency-resolution metadata, including the KaTeX/Commander update. The new Commander dependency declares Node >=22.12.0; environments installing these development dependencies should satisfy that requirement.
• Exact-head checks captured for this review: build, markdown-quality and dependency/security separation passed. Other reviewer checks were still pending; these are not represented as completed checks.
• Patch conflict-marker and trailing-whitespace checks passed.
• No PR code, installation scripts or local test commands were executed. The PR author's test results are reported evidence, not independently rerun verification.

No blocking issue identified; approved for this exact head.