From b8bf7e757a49cdcba4a147920e54bb8f14b03fb7 Mon Sep 17 00:00:00 2001
From: kanywst <45947799+kanywst@users.noreply.github.com>
Date: Sun, 8 Nov 2026 11:57:12 +0900
Subject: [PATCH 1/2] fix(deps): override minimatch and re2js to patched
 versions

minimatch <11.0.1 (GHSA-g3hv-75wg-m249) comes in through eslint and
typescript-eslint, whose latest releases still ask for ^10; re2js <2.8.7 comes
in through markdownlint 0.42.0, which markdownlint-cli2 0.24.0 pins exactly.
Neither parent has a fixed release, so pin the patched versions with
overrides.
---
 package-lock.json | 26 +++++++++++++++++---------
 package.json      |  4 +++-
 2 files changed, 20 insertions(+), 10 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 4e638e4..a627d97 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -768,6 +768,13 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
+    "node_modules/@isaacs/nonrecursive-glob-match": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/nonrecursive-glob-match/-/nonrecursive-glob-match-1.1.0.tgz",
+      "integrity": "sha512-GPm/Dbvk5RLmhRnxXIa7nTpK0xtl4E0wj0MslsuNiJ1FIROU+2+9lgUC/dgF7Ey4QCWhfEsgxilMRMCdHPfDfw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
     "node_modules/@jridgewell/gen-mapping": {
       "version": "0.3.13",
       "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz",
@@ -4547,16 +4554,17 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.6",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
-      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
+      "version": "11.0.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-11.0.5.tgz",
+      "integrity": "sha512-snPlVppFcYWfLLFQGhDxUyBcHNtMlWmn3jtj7pEaO+DP8pqL0IvAzXhMYmn1z9ASNtgmwLBdFxSf4tMUB0OTKA==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.8"
+        "@isaacs/nonrecursive-glob-match": "^1.1.0",
+        "brace-expansion": "^5.0.12"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
@@ -4904,13 +4912,13 @@
       "license": "MIT"
     },
     "node_modules/re2js": {
-      "version": "2.8.6",
-      "resolved": "https://registry.npmjs.org/re2js/-/re2js-2.8.6.tgz",
-      "integrity": "sha512-xLgQil4kIUCrAzVk9fRSkxkFNwmygLFjVxXrLc65aE1F0+Zsb8rxumFBy4XKyvgMCTL6kilDq3EZ0piE2dP/Dg==",
+      "version": "2.9.1",
+      "resolved": "https://registry.npmjs.org/re2js/-/re2js-2.9.1.tgz",
+      "integrity": "sha512-JIT3bEEUZTOR2YS1walNEIfH4cF/cQeZcBUFq7ldqO6lR6g0X5CBq/S8rsa9omzZcsNf8qc36jCkWpKKtncrZg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">=18.0.0"
+        "node": ">=20.0.0"
       }
     },
     "node_modules/react": {
diff --git a/package.json b/package.json
index f423713..af1840d 100644
--- a/package.json
+++ b/package.json
@@ -56,6 +56,8 @@
   },
   "overrides": {
     "smol-toml": "1.9.0",
-    "katex": "0.18.10"
+    "katex": "0.18.10",
+    "minimatch": "11.0.5",
+    "re2js": "2.9.1"
   }
 }

From 99810b7f1a7262ebf3f4f76ee25a7a441f0ca577 Mon Sep 17 00:00:00 2001
From: kanywst <45947799+kanywst@users.noreply.github.com>
Date: Sun, 8 Nov 2026 11:57:21 +0900
Subject: [PATCH 2/2] fix(deps): bump zod to 4.6.7 in the lockfile
 (GHSA-mrhx-c7xc-m3w5)

---
 package-lock.json | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index a627d97..ed8fdeb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -6092,9 +6092,9 @@
       }
     },
     "node_modules/zod": {
-      "version": "4.6.5",
-      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.5.tgz",
-      "integrity": "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q==",
+      "version": "4.6.7",
+      "resolved": "https://registry.npmjs.org/zod/-/zod-4.6.7.tgz",
+      "integrity": "sha512-g8W2D2kU6a8untc053fX1uVBKzM7yqAxW/3zwk83+6RyF2+SKOuV+c0wBDhUwzV1PaGapmZH+rmcUzPf+3CGwg==",
       "dev": true,
       "license": "MIT",
       "funding": {