[kanywst]

Clears the open Dependabot alerts (minimatch medium, re2js high, katex low). All three are dev-only transitive dependencies that a plain npm audit fix cannot reach, so they are pinned with overrides, as in 0-draft/aws-credentials#18:

• minimatch → 11.0.5 (via eslint / typescript-eslint; no patched 10.x exists)
• re2js → 2.9.1 (markdownlint-cli2 0.24.0 pins markdownlint 0.42.0, which pins the vulnerable re2js)
• katex → 0.18.10 (via markdownlint's micromark-extension-math, which asks for 0.16)

Verification (local)

• npm audit → found 0 vulnerabilities
• npm run check (typecheck, lint, format, markdownlint, 244 tests, build) → pass

[coderabbitai]

Important

• Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 642b4c6a-211d-4bf3-85e9-0faa571c8d90

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[claude]

No findings: the diff only adds pinned overrides (katex, minimatch, re2js) and their lockfile entries. The new engine floors (commander >=22.12, minimatch 20 || >=22) are within the repo's node >=24.