chore(frontend): bump katex to 0.18.6

[AdamEXu]

What & why

Frontend-only dependency bump for KaTeX math rendering.

Supply-chain: katex@0.18.6 aged ≥7d (published 2026-09-05), OSV clean. Deferred 0.18.7 as <7d fresh (published 2026-09-06). Deferred lucide/next/react majors/fresh patches, fumadocs (already at 16.15.7), TypeScript 7, and ESLint 10.

Bumped

• katex: ^0.18.5 / lock 0.18.5 → ^0.18.6 / lock 0.18.6

Skipped (fresh, majors, or already current)

• katex@0.18.7 — under 7-day freshness window
• fumadocs — already at 16.15.7
• lucide-react — leave at ^1.41.0
• next — leave at 16.3.4
• react / react-dom — leave at 19.2.8
• TypeScript 7
• ESLint 10
• any other package

Area

• Frontend
• Backend
• Scraper
• Convex
• Infra / tooling

How tested

• Edited frontend/package.json and regenerated frontend/pnpm-lock.yaml with pnpm add katex@0.18.6
• Lockfile specifier ^0.18.6 resolves to katex@0.18.6 (not 0.18.7)
• Installed package reports version 0.18.6
• pnpm typecheck passed
• pnpm build passed (Next.js 16.3.4 Turbopack production build)
• pnpm lint still fails on pre-existing app issues (setState-in-effect, unused vars, generated .source/ files); none of those files changed in this PR

Security checklist

• Endpoints returning user data enforce ownership / authorization (no IDOR — a user cannot read another user's data). N/A — frontend dep bump only
• @auth_required is applied to routes that need authentication. N/A
• No SSRF: any outbound/scraped URL is validated (scheme + host) before it is fetched. N/A
• No secrets committed — no .env, *.db, keys, or credentials in the diff.
• Flask debug mode is not forced on in a production code path. N/A
• OAuth tokens stay encrypted at rest and are never logged or returned in responses. N/A

Checks

• cd frontend && pnpm lint passes. (pre-existing failures; not introduced here)
• Backend still starts and affected endpoints work (make dev-backend). N/A — no backend changes

  

[greptile-apps]

Greptile Summary

The frontend now uses KaTeX 0.18.6 for its existing math-rendering pipeline. The package declaration and lockfile move from 0.18.5 to 0.18.6.

Confidence Score: 5/5

This dependency-only change appears safe to merge.

The manifest and lockfile agree on katex 0.18.6. Frozen CI and container installs use that lock entry, and no concrete rendering break was found.

Important Files Changed

Filename	Overview
frontend/package.json	Raises the direct katex range to ^0.18.6. The matching lockfile keeps CI and container installs on 0.18.6.
frontend/pnpm-lock.yaml	Updates the root katex specifier, package key, checksum, and snapshot from 0.18.5 to 0.18.6. The lock entries stay consistent.

Sequence Diagram

sequenceDiagram
    participant Build as CI or container build
    participant Pnpm as pnpm
    participant Lock as pnpm-lock.yaml
    participant App as Next.js app
    participant Markdown as ReactMarkdown
    participant Rehype as rehype-katex
    Build->>Pnpm: pnpm install --frozen-lockfile
    Pnpm->>Lock: Read katex 0.18.6 and checksum
    Lock-->>Pnpm: Locked package metadata
    Pnpm-->>Build: Install katex 0.18.6
    App->>App: Load katex 0.18.6 stylesheet
    App->>Markdown: Render chat Markdown
    Markdown->>Rehype: Send parsed math nodes
    Rehype-->>Markdown: Return KaTeX markup
    Markdown-->>App: Show formatted math

Loading

_{Reviews (1): Last reviewed commit: "chore(frontend): bump katex to 0.18.6" | Re-trigger Greptile}