deno-gfm

Bumps from 2.11.0 to 2.16.4 in (within its declared range), pulling in patched versions of several transitive dependencies used only by the CSS build tooling: fixes ReDoS in plugins (GHSA-xpqw-6gx7-v673, high), arbitrary code load via untrusted config (GHSA-2p49-hgcm-8545, high), and prototype pollution (GHSA-w27v-7q3p-w38r, high; GHSA-4vpr-x523-8j87, moderate) fixes prototype pollution/DoS issues (GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-2883-xcg3-v3hh, all high; GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m, moderate) fixes ReDoS (GHSA-73wf-gq98-2v4g, high) fixes prototype pollution (GHSA-xvcm-6775-5m9r, GHSA-v56q-mh7h-f735, GHSA-wf6x-7x77-mvgw, all high) fixes output validation issue (GHSA-xq7p-g2vc-g82p, high) fixes uncontrolled resource consumption (GHSA-grv7-fg5c-xmjg, high) fixes ReDoS (GHSA-3v7f-55p6-f55p, moderate) fixes origin validation error (GHSA-qm9p-f9j5-w83w, moderate) Only changes. All of these are devDependencies of the style build (used to generate the checked-in CSS at release time) and are not themselves part of the published package. in reports zero remaining vulnerabilities. Note: regenerating () against these updated build tools produces a smaller, differently-minified CSS bundle (equivalent color/shorthand notation, and it drops some prefixed rules that browserslist no longer considers necessary). That regeneration is intentionally left out of this PR to keep the diff scoped to the dependency bump.

CI is currently red on and on every open PR, including the Dependabot fix in #146, for a reason unrelated to any of them. imports and is listed in , so KaTeX resolves to whatever patch release is current rather than to a pinned version. It has since moved to 0.16.47, which rounds one em value differently — became — and the checked-in HTML fixtures no longer match. That fails "Math rendering" and "Math rendering in code block" regardless of what a PR changes. This regenerates the two affected fixtures through the library's own . The diff is 3 lines across 2 files and contains nothing but that rounding change; was unchanged, so only the rendered HTML had drifted. Verified locally: now passes 45/45, and , and are all clean. Worth flagging: this will recur the next time KaTeX changes its output, because the range still floats. The durable fixes are to pin KaTeX to an exact version in , or to stop asserting its HTML byte for byte. Both are judgement calls for the maintainers, so this PR only unbreaks CI rather than making that decision.

should be