[elkaix]

Requirement or Bug

pnpm audit (the required Security audit check) fails on main and on every open PR because of GHSA-vfgh-jcmw-g37q (markdown-it, quadratic-time denial of service, published 2026-10-20).

Bug Reproduction Steps

1. Check out main.
2. Run pnpm audit. It reports markdown-it 14.3.2 (<14.3.3) through apps/vscode > @vscode/vsce > markdown-it and exits non-zero.

Root Cause

The root override "markdown-it": ">=14.3.1 <15" lets the lockfile keep 14.3.2, which is inside the affected range.

Code Changes

  package.json  pnpm.overrides
-   "markdown-it": ">=14.3.1 <15"
+   "markdown-it": ">=14.3.3 <15"

• pnpm-lock.yaml regenerated with pnpm: markdown-it 14.3.3.
• The lockfile is a web build input, so apps/pythinker-code/dist-web is restaged with pnpm run build:web.
• flake.nix pnpmDeps hash refreshed.

No new dependencies.

Behavior Changes and Affected Users

Behavior	Before	After	Who relies on the old behavior	Escape hatch
Resolved markdown-it (VS Code extension packaging tool)	14.3.2	14.3.3	Nobody	n/a

Local checks: pnpm audit exits 0, check-web-assets OK, nix build .#pythinker-code passes. [skip changeset] Users cannot see this change: it moves a packaging tool dependency to a patch release.

Checklist

• I have read the CONTRIBUTING document.
• I have linked a related issue (external PRs: issue must have a maintainer's /approve).
• I have added tests that prove my feature works.
• The behavior-change table above is complete, and every removed behavior or flipped default is named in the changeset and either has an escape hatch or was explicitly approved by a maintainer in this PR.
• Ran gen-changesets skill, or this PR needs no changeset.
• Ran gen-docs skill, or this PR needs no doc update.

Summary by CodeRabbit

• Chores
  • Updated the Markdown rendering component to a newer compatible patch release.
  • Refreshed package integrity information used during project setup and builds.
  • Regenerated web bundle metadata to reflect the latest build contents.
• User Impact
  • No direct changes to the product interface or available functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: PyModel/pythinker-code/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: a6ea6e35-0d31-4820-8c08-7cc3d01fb65d

📥 Commits

Reviewing files that changed from the base of the PR and between 3769e89 and 66f3a86.

⛔ Files ignored due to path filters: 1

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml, !**/pnpm-lock.yaml

📒 Files selected for processing: 3

• apps/pythinker-code/dist-web/.web-bundle-manifest.json
• flake.nix
• package.json

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The markdown-it override now requires version >=14.3.3 <15. The pnpm dependency hash and web bundle sourceHash also changed.

Changes: Dependency and Build Metadata

Layer / File(s)	Summary
Version and hash updates package.json, flake.nix, apps/pythinker-code/dist-web/.web-bundle-manifest.json	The markdown-it minimum version changed from 14.3.1 to 14.3.3. The pnpm dependency hash and web bundle sourceHash changed.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 66f3a

The security-version update and associated hashes present no established merge-blocking risk.

Pre-merge checks: 5

Check name	Status	Explanation
Title check		The title uses the required conventional-commit prefix, stays within 72 characters, uses imperative mood, and accurately describes the markdown-it dependency update.
Description check		The description includes all required sections, explains the vulnerability and root cause, documents the code and behavior changes, and reports validation results. The related-issue checklist item rem…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description includes all required sections, explains the vulnerability and root cause, documents the code and behavior changes, and reports validation results. The related-issue checklist item remains unchecked, so an approved issue link should be added if this repository requires one for the PR.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (3 skipped: 3 unsupported.)

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@pymodel/pythinker-code@66f3a86

npx https://pkg.pr.new/@pymodel/pythinker-code@66f3a86

commit: 66f3a86