From 519c0a2a6dc11c1b0225bc0b367d2223ff9db8bc Mon Sep 17 00:00:00 2001
From: Mario Limonciello <mario.limonciello@amd.com>
Date: Tue, 14 Jul 2026 16:40:10 -0500
Subject: [PATCH] Bump katex to ^0.16.10 to fix known CVEs

KaTeX versions < 0.16.10 are affected by several security issues:

- CVE-2024-28243: maxExpand denial of service via \edef macro recursion
- CVE-2024-28244: maxExpand bypass through Unicode sub/superscripts
- CVE-2024-28245: \includegraphics does not escape the filename,
  allowing HTML injection
- CVE-2024-28246: trust-function protocol bypass

Raise the devDependency floor from ^0.15.6 to ^0.16.10 and regenerate
the lockfile so builds and CI no longer pin a vulnerable KaTeX release.
---
 package-lock.json | 36 ++++++++++++------------------------
 package.json      |  2 +-
 2 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index c9258ac..6474f20 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,18 +1,15 @@
 {
   "name": "markdown-it-texmath",
-  "version": "0.9.7",
+  "version": "1.0.1",
   "lockfileVersion": 2,
   "requires": true,
   "packages": {
     "": {
       "name": "markdown-it-texmath",
-      "version": "0.9.7",
+      "version": "1.0.1",
       "license": "MIT",
-      "dependencies": {
-        "mathjax": "^3.2.1"
-      },
       "devDependencies": {
-        "katex": "^0.15.6",
+        "katex": "^0.16.10",
         "markdown-it": "^13.0.1"
       }
     },
@@ -44,16 +41,17 @@
       }
     },
     "node_modules/katex": {
-      "version": "0.15.6",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.15.6.tgz",
-      "integrity": "sha512-UpzJy4yrnqnhXvRPhjEuLA4lcPn6eRngixW7Q3TJErjg3Aw2PuLFBzTkdUb89UtumxjhHTqL3a5GDGETMSwgJA==",
+      "version": "0.16.47",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
+      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
       "dev": true,
       "funding": [
         "https://opencollective.com/katex",
         "https://github.com/sponsors/katex"
       ],
+      "license": "MIT",
       "dependencies": {
-        "commander": "^8.0.0"
+        "commander": "^8.3.0"
       },
       "bin": {
         "katex": "cli.js"
@@ -84,11 +82,6 @@
         "markdown-it": "bin/markdown-it.js"
       }
     },
-    "node_modules/mathjax": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/mathjax/-/mathjax-3.2.1.tgz",
-      "integrity": "sha512-blUch14trKnfQHjDjy1kdg5bN8jK0bdHbkerQBKCrZ3Anpb81zZ7xnj5J55vsqQoG+Irz3BHBDzRssjeehkzxg=="
-    },
     "node_modules/mdurl": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-1.0.1.tgz",
@@ -122,12 +115,12 @@
       "dev": true
     },
     "katex": {
-      "version": "0.15.6",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.15.6.tgz",
-      "integrity": "sha512-UpzJy4yrnqnhXvRPhjEuLA4lcPn6eRngixW7Q3TJErjg3Aw2PuLFBzTkdUb89UtumxjhHTqL3a5GDGETMSwgJA==",
+      "version": "0.16.47",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
+      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
       "dev": true,
       "requires": {
-        "commander": "^8.0.0"
+        "commander": "^8.3.0"
       }
     },
     "linkify-it": {
@@ -152,11 +145,6 @@
         "uc.micro": "^1.0.5"
       }
     },
-    "mathjax": {
-      "version": "3.2.1",
-      "resolved": "https://registry.npmjs.org/mathjax/-/mathjax-3.2.1.tgz",
-      "integrity": "sha512-blUch14trKnfQHjDjy1kdg5bN8jK0bdHbkerQBKCrZ3Anpb81zZ7xnj5J55vsqQoG+Irz3BHBDzRssjeehkzxg=="
-    },
     "mdurl": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/mdurl/-/mdurl-1.0.1.tgz",
diff --git a/package.json b/package.json
index 07ede6e..482f4b6 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
   },
   "license": "MIT",
   "devDependencies": {
-    "katex": "^0.15.6",
+    "katex": "^0.16.10",
     "markdown-it": "^13.0.1"
   }
 }