Merge upstream main, resolve conflicts, preserve KaTeX math support and rebuild dist

[OrF8]

Motivation

• Bring the fork up to date with the latest upstream main while keeping the LaTeX/KaTeX math feature and upstream changes (mermaid, styling, build output).
• Resolve merge conflicts in source files and regenerate dist so the built site matches the merged sources.

Description

• Resolved source conflicts and preserved both upstream changes and the KaTeX feature in these files: index.html, public/css/style.css, src/main.js, package.json (and package-lock.json updated by npm install).
• Kept the exact KaTeX stylesheet link and SRI in index.html and updated the module URL query versions to match upstream asset versioning; ensured the script entry remains the upstream bundle entry.
• Merged KaTeX integration into the current upstream renderer in src/main.js: dynamic import of marked-katex-extension with throwOnError: false, PDF export now derives KaTeX stylesheet attributes from the DOM link and rewrites font URLs for PDFs, preserved DOMPurify sanitization and mermaid handling from upstream.
• Merged styling: kept upstream Mermaid and other styling updates and merged math-specific styles (readable inline/display math) into public/css/style.css without reintroducing problematic overflow combos.
• Rebuilt generated files using the project build (vite): regenerated dist/index.html and dist/css/style.css and rebuilt assets so dist comes from the build output rather than manual edits.
• Commit created with message: Merge upstream main and resolve PR conflicts (hash: f93585bfe79e760f2028cb77d1c8c4e4b4254ea1).

Testing

• Ran npm install to ensure dependencies (including mermaid and KaTeX-related runtime usage) are present; installation completed successfully.
• Ran npm run build (Vite build) and the build succeeded; dist was regenerated and contains the KaTeX stylesheet link and merged CSS.
• Started dev server with npm run dev and performed automated smoke checks: curl -I http://127.0.0.1:5173/ returned 200 OK and curl -I https://cdn.jsdelivr.net/npm/katex@0.16.22/dist/katex.min.css returned 200 OK.
• Verified KaTeX SRI: computed SHA-384 for the CDN CSS matched the configured integrity value sha384-5TcZemv2l/9On385z///+d7MSYlvIEw9FuZTIdZ14vJLqWphw7e7ZPuOiCHJcFCP.
• Searched for unresolved conflict markers (<<<<<<<, =======, >>>>>>>) and performed git diff --check; no conflict markers remain.
• Local repository checks: git status clean prior to merge, created merge commit (hash above).

Notes/limitation: the push to origin main failed in this environment due to missing GitHub credentials (fatal: could not read Username for 'https://github.com': No such device or address), so the branch was updated locally and the merge commit is ready to be pushed from an authenticated environment to update PR tanabe#148 on GitHub.

---

Codex Task

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	mermaid@​11.15.0

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm cytoscape is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/mermaid@11.15.0 → npm/cytoscape@3.33.4 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/cytoscape@3.33.4. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm mermaid is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/mermaid@11.15.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm mermaid is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/mermaid@11.15.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm mermaid is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/mermaid@11.15.0 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/mermaid@11.15.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm robust-predicates is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package-lock.json → npm/mermaid@11.15.0 → npm/robust-predicates@3.0.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/robust-predicates@3.0.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report