[kacigaya]

Problem

The lockfile resolves versions affected by 14 dependency advisories across six packages. Electron 44.9.3 already fixes the other four listed advisories.

Change

Update direct and transitive copies, including mobile KaTeX. Keep undici on its existing major lines.

• DOMPurify: 3.4.16 to 3.4.17
• fast-uri: 3.1.8 to 3.1.9
• KaTeX: 0.16.47 to 0.18.2
• seroval: 1.5.4 to 1.6.3
• shell-quote: 1.10.0 to 1.11.0
• undici: 6.29.1, 7.30.1, and 8.12.2

Scope and approval

This PR only updates dependencies with published security fixes. It adds no features or intentional workflow changes.

Verification

Verified on Linux with Node 26.12.1:

• Frozen install, web typecheck, web build, and packaged server build passed.
• Focused HTTP, catalog, Markdown, and mobile parsing tests: 35 passed. One test for Node's bundled undici 7 was skipped.
• OSV: none of the 18 listed advisories remain. The full scan still finds 22 unrelated advisory records.
• Production build in Chromium: inline/display math, Mermaid math labels, blocked math links, invalid TeX fallback, settings persistence, command palette, and file preview passed.

Desktop and native mobile builds were not tested.

gpt-6.1-sol in Codex

[macroscopeapp]

Approvability

Verdict: Needs Human Approval

Macroscope's review found this PR requires human approval — This dependency remediation changes runtime sanitization, Markdown/math rendering, HTTP, serialization, and other transitive behavior across web, server, and mobile paths. Its explicit security-advisory scope and broad overrides warrant human review despite the absence of application-source changes.

^{You can add or adjust custom eligibility rules. Learn more.}

[coderabbitai]

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: pingdotgg/t3code
• Branch: main
• File: .coderabbit.config.ts
• Commit: 5b35402
• Layers: Repository TS config
• Review profile: CHILL
• Plan: Advanced
• Run ID: 68108472-65fc-42b7-91d1-6d14fa3e699c

Commits

Reviewing files that changed from the base of the PR and between 5b35402 and 2e94504.

Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

Files selected for processing: 2

• apps/web/package.json
• pnpm-workspace.yaml

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 9 remain after this review.

Walkthrough

The pull request updates the dompurify and katex dependency ranges in the web package. It also updates the workspace undici catalog version and adds version overrides for six dependencies.

Changes: Dependency version updates

Layer / File(s)	Summary
Web dependencies and workspace resolutions apps/web/package.json, pnpm-workspace.yaml	The web package updates dompurify to ^3.4.17 and katex to ^0.18.2. The workspace updates the undici catalog version to 8.12.2 and adds overrides for fast-uri, katex, seroval, shell-quote, and undici versions ^6 and ^7.

Priority: Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Other

Possibly related issues

• [Bug]: 12 packages in pnpm-lock.yaml have high or critical security advisories #23907 — The issue identifies vulnerable dependency resolutions, including dompurify, seroval, and shell-quote; this pull request updates those dependency versions or overrides.

Possibly related PRs

• pingdotgg/t3code#23988 — That PR adds an install check triggered by changes to the same dependency files.

Suggested reviewers: yash-singh1, juliusmarminge

Merge Risk: Minimal · up to 2e945

The dependency advisory updates are mergeable with no identified implementation risk.

Pre-merge checks: 4

Check name	Status	Explanation
Title check		The title clearly and concisely describes the dependency advisory fixes covered by the pull request.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Description check		The description includes all required sections. It explains the advisory problem, lists the dependency changes, defines the focused scope, and reports detailed verification results and limitations. It…

Full details: Description check

Explanation

The description includes all required sections. It explains the advisory problem, lists the dependency changes, defines the focused scope, and reports detailed verification results and limitations. It does not link an issue or maintainer approval, but it explains why the change is a narrow security-only dependency update.

Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}