chore(deps): bump mathlive from 0.108.2 to 0.110.0 - #6058
Conversation
dependabot
Bot
added
dependencies
🔵 Review postedLast updated: 2026-08-02 21:32 UTC |
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6058 — mathlive 0.108.2 → 0.110.0 (production dependency, package.json line 85). CI passing (frontend tests, asset build, browser smoke test, linting).
Semver: 0.x minor. Crosses the ^0.108.2 range, so breaking-eligible by convention — but the changelog across 0.108.3 → 0.110.0 lists no breaking changes, no deprecations, and no new peer dependencies. Additive only: validateLatex gains a macros option, static-math-element types exported. Studio uses neither. No code changes required.
Security fix — the main reason to take this. 0.110.0 fixes an XSS (#3028) where the body of \text{} / \mbox{} was reflected unescaped into HTML and MathML — including the editor path. Studio doesn't call convertLatexToMarkup() or use <math-span>/<math-div>, but MathNodeView.vue:11-16 renders <math-field read-only :value="node.attrs.latex"> from stored document content. Channels are collaboratively edited, so this is a real stored-XSS vector that the bump closes.
Also relevant: 0.108.3 fixes undefined is not an object (evaluating 'this.ariaLiveText.textContent=""') in Vue runtime-only builds (#2906) — Studio is one. Confirmed in the published dists: 0.108.2 accesses ariaLiveText unguarded, 0.110.0 guards both teardown and announce.
Behavioural change to know about: #2963 — a font variant applied to the first character of an expression now serializes as \mathrm{H} rather than a bare H. Correctness fix; stored LaTeX still renders, no migration needed.
Lockfile noise: the 28-minor transitive jump @cortex-js/compute-engine 0.30.2 → 0.58.0 (plus new @arnog/colors) has no bundle impact — mathlive's dist never imports compute-engine, only names it in "load this yourself" error strings, and mathlive.min.mjs grows 0.2%. Its engines: node >=21.7.3 vs Studio's 20.x pin is pre-existing (0.30.2 declared the same) and inert. react-is 19.2.7 → 19.2.8 is an unrelated dev-only float.
One manual check worth doing before merge: jest_config/jest.conf.js:21 maps mathlive to identity-obj-proxy, so no test loads the real library — green frontend tests aren't evidence of runtime compatibility. Studio's a11y workaround depends on undocumented internals (useMathLiveA11yAnnounce.js patches the textContent setter on shadowRoot.querySelector('[aria-live]'); mathLiveA11yLocalize.js regex-matches hardcoded English announcements). I diffed both against the 0.110.0 dist and they hold — shadow DOM structure byte-identical, all six English patterns present with identical occurrence counts, announcements still assigned via textContent not innerHTML — but that's read off a minified bundle. A quick pass through the formula editor with a screen reader would close it properly. Upstream #2948 is still open, so the workaround stays.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
|
@dependabot rebase |
Bumps [mathlive](https://github.com/arnog/mathlive) from 0.108.2 to 0.110.0. - [Release notes](https://github.com/arnog/mathlive/releases) - [Changelog](https://github.com/arnog/mathlive/blob/master/CHANGELOG.md) - [Commits](arnog/mathlive@v0.108.2...v0.110.0) --- updated-dependencies: - dependency-name: mathlive dependency-version: 0.110.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
f2a6295 to
7303907
Compare
rtibblesbot
left a comment
rtibblesbot
left a comment
There was a problem hiding this comment.
PR #6058 — re-review after rebase: all prior findings resolved or acknowledged; 1 still open (manual screen-reader pass before merge).
mathlive 0.108.2 → 0.110.0 — minor, production dependency (package.json:85, ^0.108.2). Transitively: @cortex-js/compute-engine 0.30.2 → 0.58.0 and a new @arnog/colors 0.5.0. CI passing on the rebased head (7303907).
- Breaking changes: none in range.
- Peer dependencies: no new or changed peers.
- Security: XSS fix in
\text{}/\mbox{}rendering (mathlive #3028) — the main reason to take this bump. - Behavioral: #2906 adds an
ariaLiveTextguard that fixes a Vue runtime-only-build crash Studio was exposed to; #2963 serializes a first-character font variant as\mathrm{H}(correctness fix, no migration).
The rebase dropped the unrelated react-is float, so the lockfile diff is now exactly the mathlive bump.
Still open — manual screen-reader pass over the formula editor before merge. jest_config/jest.conf.js:21 maps mathlive to identity-obj-proxy, so green frontend tests are not evidence that the real library still works. useMathLiveA11yAnnounce.js and mathLiveA11yLocalize.js depend on undocumented mathlive internals (the shadow-DOM [aria-live] node and English announcement strings), and no consumer-side code changed on either side of the rebase — so this is a maintainer check, not an action for dependabot. One pass through the formula editor with a screen reader closes it.
Prior-finding status
RESOLVED — pnpm-lock.yaml — unrelated react-is 19.2.7 → 19.2.8 float in the lockfile
ACKNOWLEDGED — package.json:85 — 0.x minor crossing ^0.108.2; no breaking changes, deprecations, or new peer deps in range
ACKNOWLEDGED — package.json:85 — XSS fix #3028 in \text{} / \mbox{} rendering is the primary reason to take this bump
ACKNOWLEDGED — package.json:85 — #2906 ariaLiveText guard fixes a Vue runtime-only-build crash Studio was exposed to
ACKNOWLEDGED — package.json:85 — #2963 first-character font-variant now serializes as \mathrm{H}; correctness fix, no migration
ACKNOWLEDGED — pnpm-lock.yaml — @cortex-js/compute-engine 0.30.2 → 0.58.0 has no bundle impact; its engines: node >=21.7.3 mismatch is pre-existing and inert
UNADDRESSED — package.json:85 — manual screen-reader pass over the formula editor before merge (jest maps mathlive to identity-obj-proxy, so CI cannot cover the a11y workaround)
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Ran a dependency-update review pipeline over the version bump:
- Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
- Extracted the changelog and release notes across the version range
- Assessed compatibility with this project's usage and whether any code changes are required
- Treated CI as the primary safety net
- Scaled the review depth to the update's risk
- Chose the verdict from semver risk, changelog findings, and CI status
rtibbles
left a comment
rtibbles
left a comment
There was a problem hiding this comment.
no concerns from changelog and manual QA checks out.
2 participants
Bumps mathlive from 0.108.2 to 0.110.0.
Changelog
Sourced from mathlive's changelog.
... (truncated)
Commits
b0a4b030.110.05fe1c46fixed #3028: address XSS vulnerability in text-mode content rendering25db1a8fixed #3030bff8a46Merge pull request #2964 from Meinzzzz/master13563e1fix: fixed #2963778967fMerge branch 'master' of https://github.com/arnog/mathlive243f782Merge pull request #3008 from psiservices-uwidmark/masteraa77916chore: update to CE 0.58a07ca15Merge pull request #3029 from nwalters512/upgrade-compute-engine-0.58.0bae49ceMerge pull request #3009 from tsuji-riya/export-math-static-elements