chore(deps): bump mathlive from 0.108.2 to 0.110.0

[dependabot]

Bumps mathlive from 0.108.2 to 0.110.0.

Changelog

Sourced from mathlive's changelog.

0.110.0 2026-06-08

Security Advisories

• #3028 Fixed a cross-site scripting (XSS) vulnerability in the rendering of text-mode content. The body of \text{}, \mbox{} and similar commands accepts arbitrary characters, which were reflected unescaped into both the HTML markup (convertLatexToMarkup(), the editor, and the <math-span> / <math-div> static elements) and the MathML output (convertLatexToMathMl()). Input such as \text{<img src=x onerror=alert(1)>} could therefore execute arbitrary JavaScript when the output was inserted into the DOM. Text content and delimiters are now HTML-escaped in both output paths. Applications that render untrusted LaTeX should upgrade.

Resolved Issues

• #2949 Fixed the layout of fill-in-the-blank prompts that contain content. The prompt's outline box now correctly encloses and aligns with its content, including tall content such as fractions, with improved vertical alignment. This regression was introduced by the fix for #2515; note that #2515 (placeholders inside accent commands such as \vec{} cannot be filled) remains unresolved and is tracked separately. (contributed by @​Scienthousiaste)

• #2963 Fixed font style (variant) changes being ignored for the first character of an expression (or block). Applying a font style such as Roman Upright to the first character now serializes correctly (e.g. \mathrm{H} instead of a bare H), matching what is displayed in the mathfield. (contributed by @​psiservices-uwidmark)

• #2964 Fixed duplicate atoms accumulating when setValue() is called repeatedly with incomplete LaTeX (such as \sum_{). Partially-formed atoms that contain no content are now included when collecting atoms in a range, so they are cleared on each sync instead of accumulating across update cycles. (contributed by @​Meinzzzz)

• #3030 Fixed TypeScript 6 compilation errors (TS2882) in the published type declarations. The generated .d.ts files no longer contain bare side-effect imports (such as import '../core/modes') that referenced modules not included in the package, which TypeScript 6 flags by default via noUncheckedSideEffectImports.

Improvements

• #3032validateLatex() now accepts an optional options argument with a macros dictionary, so custom macros are recognized during validation instead of being reported as unknown commands. (contributed by @​Wigny)

• #3009 The types for static math elements are now exported from the package

... (truncated)

Commits

• b0a4b03 0.110.0
• 5fe1c46 fixed #3028: address XSS vulnerability in text-mode content rendering
• 25db1a8 fixed #3030
• bff8a46 Merge pull request #2964 from Meinzzzz/master
• 13563e1 fix: fixed #2963
• 778967f Merge branch 'master' of https://github.com/arnog/mathlive
• 243f782 Merge pull request #3008 from psiservices-uwidmark/master
• aa77916 chore: update to CE 0.58
• a07ca15 Merge pull request #3029 from nwalters512/upgrade-compute-engine-0.58.0
• bae49ce Merge pull request #3009 from tsuji-riya/export-math-static-elements
• Additional commits viewable in compare view

[rtibblesbot]

🔵 Review posted

Last updated: 2026-08-02 21:32 UTC

[rtibblesbot]

PR #6058 — mathlive 0.108.2 → 0.110.0 (production dependency, package.json line 85). CI passing (frontend tests, asset build, browser smoke test, linting).

Semver: 0.x minor. Crosses the ^0.108.2 range, so breaking-eligible by convention — but the changelog across 0.108.3 → 0.110.0 lists no breaking changes, no deprecations, and no new peer dependencies. Additive only: validateLatex gains a macros option, static-math-element types exported. Studio uses neither. No code changes required.

Security fix — the main reason to take this. 0.110.0 fixes an XSS (#3028) where the body of \text{} / \mbox{} was reflected unescaped into HTML and MathML — including the editor path. Studio doesn't call convertLatexToMarkup() or use <math-span>/<math-div>, but MathNodeView.vue:11-16 renders <math-field read-only :value="node.attrs.latex"> from stored document content. Channels are collaboratively edited, so this is a real stored-XSS vector that the bump closes.

Also relevant: 0.108.3 fixes undefined is not an object (evaluating 'this.ariaLiveText.textContent=""') in Vue runtime-only builds (#2906) — Studio is one. Confirmed in the published dists: 0.108.2 accesses ariaLiveText unguarded, 0.110.0 guards both teardown and announce.

Behavioural change to know about:#2963 — a font variant applied to the first character of an expression now serializes as \mathrm{H} rather than a bare H. Correctness fix; stored LaTeX still renders, no migration needed.

Lockfile noise: the 28-minor transitive jump @cortex-js/compute-engine 0.30.2 → 0.58.0 (plus new @arnog/colors) has no bundle impact — mathlive's dist never imports compute-engine, only names it in "load this yourself" error strings, and mathlive.min.mjs grows 0.2%. Its engines: node >=21.7.3 vs Studio's 20.x pin is pre-existing (0.30.2 declared the same) and inert. react-is 19.2.7 → 19.2.8 is an unrelated dev-only float.

One manual check worth doing before merge:jest_config/jest.conf.js:21 maps mathlive to identity-obj-proxy, so no test loads the real library — green frontend tests aren't evidence of runtime compatibility. Studio's a11y workaround depends on undocumented internals (useMathLiveA11yAnnounce.js patches the textContent setter on shadowRoot.querySelector('[aria-live]'); mathLiveA11yLocalize.js regex-matches hardcoded English announcements). I diffed both against the 0.110.0 dist and they hold — shadow DOM structure byte-identical, all six English patterns present with identical occurrence counts, announcements still assigned via textContent not innerHTML — but that's read off a minified bundle. A quick pass through the formula editor with a screen reader would close it properly. Upstream #2948 is still open, so the workaround stays.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a dependency-update review pipeline over the version bump:

• Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
• Extracted the changelog and release notes across the version range
• Assessed compatibility with this project's usage and whether any code changes are required
• Treated CI as the primary safety net
• Scaled the review depth to the update's risk
• Chose the verdict from semver risk, changelog findings, and CI status

[rtibbles]

@dependabot rebase

[rtibblesbot]

PR #6058 — re-review after rebase: all prior findings resolved or acknowledged; 1 still open (manual screen-reader pass before merge).

mathlive 0.108.2 → 0.110.0 — minor, production dependency (package.json:85, ^0.108.2). Transitively: @cortex-js/compute-engine 0.30.2 → 0.58.0 and a new @arnog/colors 0.5.0. CI passing on the rebased head (7303907).

• Breaking changes: none in range.
• Peer dependencies: no new or changed peers.
• Security: XSS fix in \text{} / \mbox{} rendering (mathlive #3028) — the main reason to take this bump.
• Behavioral:#2906 adds an ariaLiveText guard that fixes a Vue runtime-only-build crash Studio was exposed to; #2963 serializes a first-character font variant as \mathrm{H} (correctness fix, no migration).

The rebase dropped the unrelated react-is float, so the lockfile diff is now exactly the mathlive bump.

Still open — manual screen-reader pass over the formula editor before merge.jest_config/jest.conf.js:21 maps mathlive to identity-obj-proxy, so green frontend tests are not evidence that the real library still works. useMathLiveA11yAnnounce.js and mathLiveA11yLocalize.js depend on undocumented mathlive internals (the shadow-DOM [aria-live] node and English announcement strings), and no consumer-side code changed on either side of the rebase — so this is a maintainer check, not an action for dependabot. One pass through the formula editor with a screen reader closes it.

Prior-finding status

RESOLVED — pnpm-lock.yaml — unrelated react-is 19.2.7 → 19.2.8 float in the lockfile
ACKNOWLEDGED — package.json:85 — 0.x minor crossing ^0.108.2; no breaking changes, deprecations, or new peer deps in range
ACKNOWLEDGED — package.json:85 — XSS fix #3028 in \text{} / \mbox{} rendering is the primary reason to take this bump
ACKNOWLEDGED — package.json:85 — #2906ariaLiveText guard fixes a Vue runtime-only-build crash Studio was exposed to
ACKNOWLEDGED — package.json:85 — #2963 first-character font-variant now serializes as \mathrm{H}; correctness fix, no migration
ACKNOWLEDGED — pnpm-lock.yaml — @cortex-js/compute-engine 0.30.2 → 0.58.0 has no bundle impact; its engines: node >=21.7.3 mismatch is pre-existing and inert
UNADDRESSED — package.json:85 — manual screen-reader pass over the formula editor before merge (jest maps mathlive to identity-obj-proxy, so CI cannot cover the a11y workaround)

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a dependency-update review pipeline over the version bump:

• Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
• Extracted the changelog and release notes across the version range
• Assessed compatibility with this project's usage and whether any code changes are required
• Treated CI as the primary safety net
• Scaled the review depth to the update's risk
• Chose the verdict from semver risk, changelog findings, and CI status

[rtibbles]

no concerns from changelog and manual QA checks out.