[kacigaya]

Problem

The lockfile resolves versions affected by 14 dependency advisories across six packages. Electron 44.9.3 already fixes the other four listed advisories.

Change

Update direct and transitive copies, including mobile KaTeX. Keep undici on its existing major lines.

• DOMPurify: 3.4.16 to 3.4.17
• fast-uri: 3.1.8 to 3.1.9
• KaTeX: 0.16.47 to 0.18.2
• seroval: 1.5.4 to 1.6.3
• shell-quote: 1.10.0 to 1.11.0
• undici: 6.29.1, 7.30.1, and 8.12.2

Scope and approval

This PR only updates dependencies with published security fixes. It adds no features or intentional workflow changes.

Verification

Verified on Linux with Node 26.12.1:

• Frozen install, web typecheck, web build, and packaged server build passed.
• Focused HTTP, catalog, Markdown, and mobile parsing tests: 35 passed. One test for Node's bundled undici 7 was skipped.
• OSV: none of the 18 listed advisories remain. The full scan still finds 22 unrelated advisory records.
• Production build in Chromium: inline/display math, Mermaid math labels, blocked math links, invalid TeX fallback, settings persistence, command palette, and file preview passed.

Desktop and native mobile builds were not tested.

gpt-6.1-sol in Codex

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This dependency remediation changes runtime sanitization, Markdown/math rendering, HTTP, serialization, and other transitive behavior across web, server, and mobile paths. Its explicit security-advisory scope and broad overrides warrant human review despite the absence of application-source changes.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 1316d48
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: a9909c58-3096-4445-a010-b024a75435d7

Commits

Reviewing files that changed from the base of the PR and between 2e94504 and 060981b.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 1

• apps/web/package.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The pull request updates the dompurify and katex dependency ranges in the web package. It also updates the workspace undici catalog version and adds version overrides for six dependencies.

Changes: Dependency version updates

Layer / File(s)	Summary
Web dependencies and workspace resolutions apps/web/package.json, pnpm-workspace.yaml	The web package updates dompurify to ^3.4.17 and katex to ^0.18.2. The workspace updates the undici catalog version to 8.12.2 and adds overrides for fast-uri, katex, seroval, shell-quote, and undici versions ^6 and ^7.

Priority: Normal

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related issues

• pingdotgg/t3code#23907 — The issue reports vulnerable resolutions for dompurify, seroval, and shell-quote. This pull request updates those dependency versions or overrides.

Suggested reviewers: yash-singh1, juliusmarminge

Merge Risk: Minimal · up to 06098

The dependency updates are mergeable with no identified actionable risk.

Pre-merge checks: 3 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Description check		The description follows the template. It has Problem, Change, Scope and approval, and Verification sections. The Problem section states the advisory issue. The Change section lists each dependency ver…	Add a link to the triaged issue or the discussion with explicit maintainer approval of this dependency update. If no prior issue exists, explain why this security dependency update qualifies as a small, focused fix without prior approval. K…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title "fix(deps): patch known dependency advisories" follows conventional commit form and names the main change. The changeset updates DOMPurify, fast-uri, KaTeX, seroval, shell-quote, and undici …
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Title check

Explanation

The title "fix(deps): patch known dependency advisories" follows conventional commit form and names the main change. The changeset updates DOMPurify, fast-uri, KaTeX, seroval, shell-quote, and undici to fix published security advisories. The title is specific enough for a teammate to see the primary change.

Full details: Description check

Explanation

The description follows the template. It has Problem, Change, Scope and approval, and Verification sections. The Problem section states the advisory issue. The Change section lists each dependency version bump. The Scope section states the PR only applies published security fixes, but it does not link a triaged issue or maintainer approval. The template asks for that link or a justification for skipping it. The Verification section lists focused tests, OSV results, and browser checks, and it states what was not tested. The description also does not state the conventional commit title, but the PR title already uses one. The missing issue or approval link is the main gap.

Resolution

Add a link to the triaged issue or the discussion with explicit maintainer approval of this dependency update. If no prior issue exists, explain why this security dependency update qualifies as a small, focused fix without prior approval. Keep the existing Problem, Change, and Verification sections as they are.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}