From 94e343561de0e49320b35b20705f0ed990b8daa2 Mon Sep 17 00:00:00 2001
From: "Nabheet S. Sandhu" <nabheet@berkeley.edu>
Date: Fri, 30 Oct 2026 22:15:13 -0600
Subject: [PATCH] chore(deps): clear the remaining dev-only advisories

`markdownlint-cli2` pulls `re2js` 2.8.6 (high) and `katex` < 0.18.2 (low) in
through `markdownlint` -> `micromark-extension-math`. Neither is fixed
upstream: markdownlint 0.42.0 still pins re2js 2.8.6 and katex ^0.16.0, and
that is the newest release.

Both are dev-only (never in the published tarball) and are used solely for
markdown linting, which is why pinning past the declared range is safe here:

- `re2js` 2.8.7 is a patch bump on the same line.
- `katex` ^0.19.1 is three minors past `micromark-extension-math`'s `^0.16.0`;
  kaTeX only renders `$$...$$` math blocks in Markdown and this repo has none.

`npm audit` -> 0 vulnerabilities.
---
 package-lock.json | 25 +++++++++++++------------
 package.json      |  4 ++++
 2 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c5bfe4b..9e2f8e1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -164,13 +164,13 @@
       }
     },
     "node_modules/commander": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz",
+      "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 12"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/debug": {
@@ -475,9 +475,9 @@
       }
     },
     "node_modules/katex": {
-      "version": "0.16.47",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
-      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
+      "version": "0.19.1",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.19.1.tgz",
+      "integrity": "sha512-jG8uKntjSEcm2EpQOh0XturpPuuC9r3Sq5HLHdsFdWZT27E672SF19QEi+of0/YeOy15lDgRhKvr5614uRrEfA==",
       "dev": true,
       "funding": [
         "https://opencollective.com/katex",
@@ -485,7 +485,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "commander": "^8.3.0"
+        "commander": "^15.0.0"
       },
       "bin": {
         "katex": "cli.js"
@@ -587,6 +587,7 @@
       "integrity": "sha512-c5hU2MDoTlS230MLzdNlkIyxImXq5acxGKz4nYz4aDhH/2BgFtpsA7iK9/OoTHMgZ4FuR0wedTQA31K6Lp9I/Q==",
       "dev": true,
       "license": "MIT",
+      "peer": true,
       "dependencies": {
         "globby": "16.2.4",
         "js-yaml": "5.4.3",
@@ -1282,13 +1283,13 @@
       "license": "MIT"
     },
     "node_modules/re2js": {
-      "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/re2js/-/re2js-2.8.6.tgz",
-      "integrity": "sha512-xLgQil4kIUCrAzVk9fRSkxkFNwmygLFjVxXrLc65aE1F0+Zsb8rxumFBy4XKyvgMCTL6kilDq3EZ0piE2dP/Dg==",
+      "version": "2.8.7",
+      "resolved": "https://registry.npmjs.org/re2js/-/re2js-2.8.7.tgz",
+      "integrity": "sha512-bRSL/vn3KAmlGfGNoVpcsBXLaVvl6AbuvMMWbz0m3vBj60nj+p2/biozfBUOSBP+5XTduF6mr6IO/ZVjmqqkVQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/reusify": {
diff --git a/package.json b/package.json
index baa72bf..0691b2c 100644
--- a/package.json
+++ b/package.json
@@ -47,5 +47,9 @@
   },
   "devDependencies": {
     "markdownlint-cli2": "^0.24.0"
+  },
+  "overrides": {
+    "katex": "^0.19.1",
+    "re2js": "2.8.7"
   }
 }