From 36f387d6a8133bdd48b9a892f1e97967110dc0db Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 26 Oct 2026 10:56:23 +0000 Subject: [PATCH 1/3] Bump markdown-it override to ~14.3.3 for Dependabot #90/#91 markdown-it enters via markdownlint-cli2 (pinned 14.3.0). Raise the existing npm overrides floor from ~14.3.1 to ~14.3.3 and refresh the lockfile entry so the resolved package is 14.3.3. Dev-dependency only. --- package-lock.json | 6 +++--- package.json | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/package-lock.json b/package-lock.json index c89739f..578af19 100644 --- a/package-lock.json +++ b/package-lock.json @@ -5722,9 +5722,9 @@ } }, "node_modules/markdown-it": { - "version": "14.3.2", - "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.2.tgz", - "integrity": "sha512-sHHjZ5fJKlgrG4qns2YwVcdNep35h5fERrfkD2YNsb9UFk0UIHarbiTaHKVMlPuWAoiilyK8Fv/jAm11slsY7Q==", + "version": "14.3.3", + "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.3.tgz", + "integrity": "sha512-L//tDAkjTjJCU6pBUSBTgs3Kg4InVaZuUZog/b6V12UKhcDQ7S78877ibbCanRExwPuYP1CZD7Gd2dxSy1GXRg==", "dev": true, "funding": [ { diff --git a/package.json b/package.json index d189aec..9c01d01 100644 --- a/package.json +++ b/package.json @@ -45,7 +45,7 @@ "fast-uri": "^3.1.7", "form-data": "^4.0.4", "js-yaml": "~5.4.1", - "markdown-it": "~14.3.1", + "markdown-it": "~14.3.3", "flatted": "^3.4.2", "postcss": "^8.5.10", "nanoid": "^3.3.18", From f10dbf1d16c0d891675b4a6e56d4af00068a9f8e Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 2 Nov 2026 10:50:36 +0000 Subject: [PATCH 2/3] =?UTF-8?q?Bump=20fast-uri=20and=20deepmerge=20overrid?= =?UTF-8?q?es=20for=20Dependabot=20#92=E2=80=93#96?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Raise fast-uri override floor to ^3.1.9 (patched 3.x line) and pin deepmerge to 4.1.2 via overrides — GHSA-gcqx-w48m-w2h4 has no patched 4.x release, and 4.1.2 is the latest version outside the vulnerable range. Refresh lockfile entries only; keep markdown-it ~14.3.3. --- package-lock.json | 56 +++++++++++------------------------------------ package.json | 3 ++- 2 files changed, 15 insertions(+), 44 deletions(-) diff --git a/package-lock.json b/package-lock.json index 578af19..7fb4c1c 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1977,9 +1977,6 @@ "cpu": [ "arm64" ], - "libc": [ - "glibc" - ], "dev": true, "license": "MIT", "optional": true, @@ -1994,9 +1991,6 @@ "cpu": [ "arm64" ], - "libc": [ - "musl" - ], "dev": true, "license": "MIT", "optional": true, @@ -2011,9 +2005,6 @@ "cpu": [ "loong64" ], - "libc": [ - "glibc" - ], "dev": true, "license": "MIT", "optional": true, @@ -2028,9 +2019,6 @@ "cpu": [ "loong64" ], - "libc": [ - "musl" - ], "dev": true, "license": "MIT", "optional": true, @@ -2045,9 +2033,6 @@ "cpu": [ "ppc64" ], - "libc": [ - "glibc" - ], "dev": true, "license": "MIT", "optional": true, @@ -2062,9 +2047,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "glibc" - ], "dev": true, "license": "MIT", "optional": true, @@ -2079,9 +2061,6 @@ "cpu": [ "riscv64" ], - "libc": [ - "musl" - ], "dev": true, "license": "MIT", "optional": true, @@ -2096,9 +2075,6 @@ "cpu": [ "s390x" ], - "libc": [ - "glibc" - ], "dev": true, "license": "MIT", "optional": true, @@ -2113,9 +2089,6 @@ "cpu": [ "x64" ], - "libc": [ - "glibc" - ], "dev": true, "license": "MIT", "optional": true, @@ -2130,9 +2103,6 @@ "cpu": [ "x64" ], - "libc": [ - "musl" - ], "dev": true, "license": "MIT", "optional": true, @@ -3101,16 +3071,6 @@ "dev": true, "license": "MIT" }, - "node_modules/deepmerge": { - "version": "4.3.1", - "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.3.1.tgz", - "integrity": "sha512-3sUqbMEc77XqpdNO7FRyRog+eW3ph+GYCbj+rK+uYyRMuwsVy0rMiVtPn+QJlKFvWP/1PYpapqYn0Me2knFn+A==", - "dev": true, - "license": "MIT", - "engines": { - "node": ">=0.10.0" - } - }, "node_modules/dequal": { "version": "2.0.3", "resolved": "https://registry.npmjs.org/dequal/-/dequal-2.0.3.tgz", @@ -3534,9 +3494,9 @@ "license": "MIT" }, "node_modules/fast-uri": { - "version": "3.1.7", - "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz", - "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==", + "version": "3.1.9", + "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.9.tgz", + "integrity": "sha512-hS/0Wt3Ya043oKXs0sIxrMpKQITXhMLIrVAKKXi4gozGC9v7YRWVnXIZzjNPTO02M9BdxLCWqK1yRXgNziVyJQ==", "dev": true, "funding": [ { @@ -4561,6 +4521,16 @@ } } }, + "node_modules/jest-config/node_modules/deepmerge": { + "version": "4.1.2", + "resolved": "https://registry.npmjs.org/deepmerge/-/deepmerge-4.1.2.tgz", + "integrity": "sha512-9ZXh/8Fp+ggcscoRg324S1aNdGSCl2X1P8F1FPTHbtq3RAxy9ECbU2Wgy2J12r6x/O0BStDlkzcpKK/HptX+Kg==", + "dev": true, + "license": "MIT", + "engines": { + "node": ">=0.10.0" + } + }, "node_modules/jest-diff": { "version": "30.4.1", "resolved": "https://registry.npmjs.org/jest-diff/-/jest-diff-30.4.1.tgz", diff --git a/package.json b/package.json index 9c01d01..35f5c75 100644 --- a/package.json +++ b/package.json @@ -42,7 +42,8 @@ "stylelint-config-standard": "^36.0.0" }, "overrides": { - "fast-uri": "^3.1.7", + "deepmerge": "4.1.2", + "fast-uri": "^3.1.9", "form-data": "^4.0.4", "js-yaml": "~5.4.1", "markdown-it": "~14.3.3", From e4f58826f05480d894f2087caff8ba2343909e2b Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Mon, 2 Nov 2026 10:56:14 +0000 Subject: [PATCH 3/3] Restore optional linux libc metadata in the lockfile npm package-lock refresh dropped libc fields on the @unrs/resolver-binding-linux-* optional packages. Put them back so the security override bump does not churn platform metadata. --- package-lock.json | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/package-lock.json b/package-lock.json index 7fb4c1c..4a0dd17 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1977,6 +1977,9 @@ "cpu": [ "arm64" ], + "libc": [ + "glibc" + ], "dev": true, "license": "MIT", "optional": true, @@ -1991,6 +1994,9 @@ "cpu": [ "arm64" ], + "libc": [ + "musl" + ], "dev": true, "license": "MIT", "optional": true, @@ -2005,6 +2011,9 @@ "cpu": [ "loong64" ], + "libc": [ + "glibc" + ], "dev": true, "license": "MIT", "optional": true, @@ -2019,6 +2028,9 @@ "cpu": [ "loong64" ], + "libc": [ + "musl" + ], "dev": true, "license": "MIT", "optional": true, @@ -2033,6 +2045,9 @@ "cpu": [ "ppc64" ], + "libc": [ + "glibc" + ], "dev": true, "license": "MIT", "optional": true, @@ -2047,6 +2062,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "glibc" + ], "dev": true, "license": "MIT", "optional": true, @@ -2061,6 +2079,9 @@ "cpu": [ "riscv64" ], + "libc": [ + "musl" + ], "dev": true, "license": "MIT", "optional": true, @@ -2075,6 +2096,9 @@ "cpu": [ "s390x" ], + "libc": [ + "glibc" + ], "dev": true, "license": "MIT", "optional": true, @@ -2089,6 +2113,9 @@ "cpu": [ "x64" ], + "libc": [ + "glibc" + ], "dev": true, "license": "MIT", "optional": true, @@ -2103,6 +2130,9 @@ "cpu": [ "x64" ], + "libc": [ + "musl" + ], "dev": true, "license": "MIT", "optional": true,