Update dependency katex to v0.16.21 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
katex (source)	0.16.10 -> 0.16.21

GitHub Vulnerability Alerts

CVE-2025-23207

Impact

KaTeX users who render untrusted mathematical expressions with renderToString could encounter malicious input using \htmlData that runs arbitrary JavaScript, or generate invalid HTML.

Patches

Upgrade to KaTeX v0.16.21 to remove this vulnerability.

Workarounds

• Avoid use of or turn off the trust option, or set it to forbid \htmlData commands.
• Forbid inputs containing the substring "\\htmlData".
• Sanitize HTML output from KaTeX.

Details

\htmlData did not validate its attribute name argument, allowing it to generate invalid or malicious HTML that runs scripts.

For more information

If you have any questions or comments about this advisory:

• Open an issue or security advisory in the KaTeX repository
• Email us at [email protected]

---

Release Notes

KaTeX/KaTeX (katex)

v0.16.21

Compare Source

Bug Fixes

• escape \htmlData attribute name (57914ad)

v0.16.20

Compare Source

Bug Fixes

• \providecommand does not overwrite existing macro (#​4000) (6d30fe4), closes #​3928

v0.16.19

Compare Source

Bug Fixes

• types: improve strict function type (#​4009) (4228b4e)

v0.16.18

Compare Source

Bug Fixes

• Actually publish TypeScript type definitions (#​4008) (629b873)

v0.16.17

Compare Source

Bug Fixes

• MathML combines multidigit numbers with sup/subscript, comma separators, and multicharacter text when outputting to DOM (#​3999) (7d79e22), closes #​3995

v0.16.16

Compare Source

Features

• ESM exports, TypeScript types (#​3992) (ea9c173)

v0.16.15

Compare Source

Features

• italic sans-serif in math mode via \mathsfit command (#​3998) (2218901)

v0.16.14

Compare Source

Features

• \dddot and \ddddot support (#​3834) (bda35cd), closes #​2744

v0.16.13

Compare Source

Bug Fixes

• \vdots and \rule support in text mode (#​3997) (0e08352), closes #​3990

v0.16.12

Compare Source

Features

• css: configurable margin for display math (#​3638) (3405001)

v0.16.11

Compare Source

Features

• add \emph (#​3963) (9f34da4), closes #​3566

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[greptile-apps]

PR Summary

This pull request updates the katex dependency from version 0.16.10 to 0.16.21 to address a security vulnerability (CVE-2025-23207).

Key points about the update:

• Fixes a security vulnerability where untrusted math expressions using \htmlData could execute arbitrary JavaScript
• Affects the Markdown preview functionality in the catalog component where KaTeX renders math expressions
• Includes multiple bug fixes and improvements from KaTeX versions 0.16.11 through 0.16.21
• Dependabot configuration ensures weekly checks for GitHub Actions and daily checks for Docker dependencies

The update is important for security but requires careful testing of math rendering functionality in the catalog's Markdown preview component.

_{💡 (3/5) Reply to the bot's comments like "Can you suggest a fix for this @greptileai?" or ask follow-up questions!}

_{No file(s) reviewed, no comment(s)
Edit PR Review Bot Settings | Greptile}

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 39.11%. Comparing base (f32fe6c) to head (acf0481).
Report is 1 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff            @@
##           master    #4292    +/-   ##
========================================
  Coverage   39.11%   39.11%            
========================================
  Files         783      783            
  Lines       34737    34737            
  Branches     5308     5517   +209     
========================================
  Hits        13586    13586            
+ Misses      20608    19970   -638     
- Partials      543     1181   +638     

Flag	Coverage Δ
api-python	91.39% <ø> (ø)
catalog	18.12% <ø> (ø)
lambda	91.48% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.