From 65b73515bf6c86b49c70ab74fcd0857d4bc4ad5d Mon Sep 17 00:00:00 2001
From: Evan Vetere <ecv@datum.net>
Date: Tue, 10 Nov 2026 09:06:47 -0500
Subject: [PATCH] fix: Override minimatch and katex lint deps

Clear two Dependabot alerts on development-only lint tooling. minimatch
10.2.6 (GHSA-g3hv-75wg-m249) comes in through eslint and typescript-eslint;
katex 0.16.47 (GHSA-238p-pmpm-9mq7) comes in through markdownlint-cli2. Their
direct parents have not released versions that move to the fixed ranges, so
npm overrides pin the patched releases.

Key changes:
- Override minimatch to ^11.0.5; eslint, @eslint/config-array and
  typescript-eslint use no API that v11 removed
- Override katex to ^0.18.2 under micromark-extension-math only; markdownlint
  never loads katex, since only the HTML renderer imports it
- Lock also moves katex's commander dependency to 15.1.0 and adds
  minimatch's @isaacs/nonrecursive-glob-match; nothing else changes

The production image installs with --omit=dev, so neither package ships.
---
 package-lock.json | 34 +++++++++++++++++++++-------------
 package.json      |  4 ++++
 2 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index d919711..218129b 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1747,6 +1747,13 @@
         "url": "https://opencollective.com/libvips"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz",
+      "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -3650,13 +3657,13 @@
       }
     },
     "node_modules/commander": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "version": "15.1.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-15.1.0.tgz",
+      "integrity": "sha512-cgnQ88TRrWcC7pVq46RzJVRMktu3W2RcbnoidnfBsl1bmDCBwJS/udcIZpKoCrbAYYaCqsz1yZCVIgbIaU3ddQ==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 12"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/common-ancestor-path": {
@@ -5202,9 +5209,9 @@
       }
     },
     "node_modules/katex": {
-      "version": "0.16.47",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
-      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
+      "version": "0.18.10",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.18.10.tgz",
+      "integrity": "sha512-/B6p9eY9DX7aHBfpkHdpirDTZ5QH9xTwL9y837PWuzuv41O5jFdqNQwVQEQsimY0/iVNkwBY4+4hMfhQ7d4Dbw==",
       "dev": true,
       "funding": [
         "https://opencollective.com/katex",
@@ -5212,7 +5219,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "commander": "^8.3.0"
+        "commander": "^15.0.0"
       },
       "bin": {
         "katex": "cli.js"
@@ -6447,16 +6454,17 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.5.tgz",
+      "integrity": "sha512-snPlVppFcYWfLLFQGhDxUyBcHNtMlWmn3jtj7pEaO+DP8pqL0IvAzXhMYmn1z9ASNtgmwLBdFxSf4tMUB0OTKA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.8"
+        "@isaacs/nonrecursive-glob-match": "^1.1.0",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
diff --git a/package.json b/package.json
index bd4b251..5331b03 100644
--- a/package.json
+++ b/package.json
@@ -58,6 +58,10 @@
     },
     "@tailwindcss/typography": {
       "postcss-selector-parser": "6.1.5"
+    },
+    "minimatch": "^11.0.5",
+    "micromark-extension-math": {
+      "katex": "^0.18.2"
     }
   }
 }