fix(deps): patch KaTeX and source-map-js security advisories

[chaxus]

Merge Verdict

[APPROVE]

The two remaining Dependabot alerts are addressed, and the full npm dependency audit reports zero vulnerabilities.

2 files · +16 / -10 · workspace dependency overrides and generated lockfile

Summary

• Resolve alert #246 by upgrading source-map-js 1.2.1 → 1.2.2 across PostCSS, css-tree and magicast consumers.
• Resolve alert #247 by upgrading Mermaid's KaTeX 0.16.47 → 0.18.2 using a scoped override.
• Follow up on merged PR fix(deps): patch undici and image probing vulnerabilities #418. No application source, parent dependency versions or public APIs change.

Risk Analysis

Risk	Level	Mitigation
KaTeX minor-version compatibility	Low	Mermaid's latest release still requests the vulnerable range. Scope the override to Mermaid; test its actual sanitized formula renderer with fractions in both MathML and legacy HTML+MathML modes, and complete the full ranui build.
Source-map processing compatibility	Low	Use the patched 1.x release and run all declared workspace tests, type checks and production builds.

Design Decisions

• Override Mermaid's KaTeX dependency rather than taking an unrelated Mermaid major upgrade that still leaves the vulnerable range.
• Use a central source-map-js override to cover every transitive consumer; the lockfile retains only the patched versions.

Code Concerns

No actionable findings. Dependency consumers were traced through the lockfile and Mermaid's runtime KaTeX call; its renderToString API and output modes remain supported.

Verification

Check	Result
npm security audit	Zero vulnerabilities at every severity
Frozen lockfile installation	Passed
Workspace tests	3227 passed, 1 skipped across 214 files
Workspace type checks	All 8 declared packages passed after the complete ranui build
ranui production build	Complete build and ES build passed
Mermaid math compatibility	Actual sanitized renderer produces fraction MathML in both supported output modes
KaTeX security behavior	An options object inheriting trust:true cannot enable javascript links
Formatting and whitespace	Passed

Conclusion basis

• Verified: pnpm audit --json, pnpm install --frozen-lockfile, pnpm test, pnpm -F ranui build, pnpm -F ranui build:es, node bin/run-checks.mjs tsc, pnpm exec prettier --check pnpm-workspace.yaml pnpm-lock.yaml, and git diff --check.
• Verified: direct runtime checks of Mermaid's renderKatexSanitized under jsdom and KaTeX's inherited-trust rejection.
• Not covered: pixel-level formula layout comparison in a real browser. GitHub default-branch alerts will close after merge and rescanning.

[cloudflare-workers-and-pages]

Deploying ran with    Cloudflare Pages

Latest commit:	5eb1abb
Status:	✅  Deploy successful!
Preview URL:	https://ceb7c3c7.ran-4ty.pages.dev
Branch Preview URL:	https://fix-security-remaining-depen.ran-4ty.pages.dev

View logs