From 554b640099e873f20a93ec4cc8c027277d2971f6 Mon Sep 17 00:00:00 2001
From: khaira777 <777gurkirat@gmail.com>
Date: Tue, 6 Oct 2026 13:13:04 -0400
Subject: [PATCH] chore(deps): pin patched dev-tooling transitive dependencies

Override http-cache-semantics to ^4.3.0, katex to ^0.18.2 and smol-toml to ^1.9.0 so the resolved tree clears Dependabot alerts #110, #115 and #116 (CVE-2026-93748, CVE-2026-103923, GHSA-r4xh-jqrq-34v2).

All three arrive only through dev tooling (the electron-builder download path and markdownlint-cli2) and none ship in the desktop package or the runtime servers. Effect on FloCafe is limited to npm run docs:check and packaging; the katex jump stays inside 0.18.x to keep the range micromark-extension-math expects.

sprintf-js (alert #117) has no patched release upstream, so it is left for a Dependabot dismissal.
---
 package-lock.json | 28 ++++++++++++++--------------
 package.json      |  5 ++++-
 2 files changed, 18 insertions(+), 15 deletions(-)

diff --git a/package-lock.json b/package-lock.json
index 82db6b897..3212361fb 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -5997,9 +5997,9 @@
       }
     },
     "node_modules/http-cache-semantics": {
-      "version": "4.2.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
-      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ==",
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.3.0.tgz",
+      "integrity": "sha512-M5t5LlJpS1UHMjvwRQVdFHvPISGeLAxNcrWuJkeGh0KxsqCHZ1O3NXZU/8x7cD0BDcGW8kapxMKTvwlqrNkHkA==",
       "dev": true,
       "license": "BSD-2-Clause"
     },
@@ -6494,9 +6494,9 @@
       }
     },
     "node_modules/katex": {
-      "version": "0.16.47",
-      "resolved": "https://registry.npmjs.org/katex/-/katex-0.16.47.tgz",
-      "integrity": "sha512-Eeo8Ys1doU1z+x8AZsPpQu+p/QcZBI5PeOo7QGQdy2x2m0MU/hYagBbGOmXwr5KVbEfVuWv9LpnQWeehogurjg==",
+      "version": "0.18.10",
+      "resolved": "https://registry.npmjs.org/katex/-/katex-0.18.10.tgz",
+      "integrity": "sha512-/B6p9eY9DX7aHBfpkHdpirDTZ5QH9xTwL9y837PWuzuv41O5jFdqNQwVQEQsimY0/iVNkwBY4+4hMfhQ7d4Dbw==",
       "dev": true,
       "funding": [
         "https://opencollective.com/katex",
@@ -6504,20 +6504,20 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "commander": "^8.3.0"
+        "commander": "^15.0.0"
       },
       "bin": {
         "katex": "cli.js"
       }
     },
     "node_modules/katex/node_modules/commander": {
-      "version": "8.3.0",
-      "resolved": "https://registry.npmjs.org/commander/-/commander-8.3.0.tgz",
-      "integrity": "sha512-OkTL9umf+He2DZkUq8f8J9of7yL6RJKI24dVITBmNfZBmri9zYZQrKkuXiKhyfPSu8tUhnVBB1iKXevvnlR4Ww==",
+      "version": "15.0.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-15.0.0.tgz",
+      "integrity": "sha512-z67u4ZhzCL/Tydu1lJARtEZYWbWaN7oYLHbsuzocr6y4N6WZAagG3RQ4FW61V1/0+jImpj293XfrcYnd1qxtPg==",
       "dev": true,
       "license": "MIT",
       "engines": {
-        "node": ">= 12"
+        "node": ">=22.12.0"
       }
     },
     "node_modules/keyv": {
@@ -9291,9 +9291,9 @@
       }
     },
     "node_modules/smol-toml": {
-      "version": "1.8.0",
-      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.8.0.tgz",
-      "integrity": "sha512-kCZr2V3ch9i00x8zXRhjUNVcjG9ijES5dDudkXvUVCT5QlJNQWElSJdZqyPemffHoLNUYwOcou0Fy+ojN0uHSQ==",
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/smol-toml/-/smol-toml-1.9.0.tgz",
+      "integrity": "sha512-hpd+HLON7HdZXqYchMM/+LaTTbdK0AU3NngIJ4KVyWbY9bfQqdL9cD+4yf6dUoU2Ap4VsU0JkQi6FxAI1B2mXQ==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {
diff --git a/package.json b/package.json
index 258e8d697..8c1023cc6 100644
--- a/package.json
+++ b/package.json
@@ -296,7 +296,10 @@
     "undici@>=7": "^7.29.1",
     "ip-address": "^10.7.1",
     "fast-uri": "^3.1.8",
-    "uuid": "^11.1.1"
+    "uuid": "^11.1.1",
+    "http-cache-semantics": "^4.3.0",
+    "katex": "^0.18.2",
+    "smol-toml": "^1.9.0"
   },
   "devDependencies": {
     "@electron/rebuild": "^4.2.0",