fix(ci): clear two new markdownlint-cli transitive CVEs (katex, smol-toml) - #478

Summary

Two new advisories landed and were GitHub-reviewed today, both reachable through [email protected]'s dependency tree (the version adopted in #471/#548's markdownlint-cli2 → markdownlint-cli migration):

• katex 0.11.0–0.18.1: CVE-2026-103923 / GHSA-238p-pmpm-9mq7, a prototype-pollution bypass of trust restrictions (low severity). Reached via markdownlint → micromark-extension-math → katex.
• smol-toml ≤1.8.0: GHSA-r4xh-jqrq-34v2, a quadratic-time parse() DoS on ordinary valid TOML input (moderate severity). Reached via markdownlint-cli → smol-toml directly.

Both have patched releases ([email protected], [email protected]) — unlike the braces CVE that prompted the markdownlint-cli2 → markdownlint-cli migration in the first place (that one had no patched release at all). This is a straightforward override bump.

Not caused by this PR, not caused by #471/#548 either

Confirmed independently: this reproduces on current main, unmodified, before making any change:

$ npm ci && npm audit --audit-level=moderate   # on main, as-is
5 vulnerabilities (3 low, 2 moderate)

Same "advisory lands, previously-green gate goes red with zero local changes" pattern as the braces CVE #471 fixed — these two were just GitHub-reviewed hours after #471/#548 merged.

Fix

Two overrides entries added to .github/linters/package.json. markdownlint-cli itself stays pinned at 0.49.1; only its own transitive katex and smol-toml resolutions move.

"overrides": {
  "js-yaml": "4.3.2",
  "katex": "0.18.2",
  "smol-toml": "1.9.0"
}

Verification

$ npm ci && npm audit --audit-level=moderate
found 0 vulnerabilities

$ node .github/linters/run-markdownlint.mjs --count-only
190

$ node .github/linters/run-markdownlint.mjs
(exit 0, clean)

190 matches the exact file-count parity established in #471.

Safety Checklist

• No secrets, tokens, credentials, or private keys
• No PII, CUI, customer data, or sensitive info
• No internal URLs or system details
• Examples use placeholders where applicable

Security Impact

Clears a moderate-severity DoS advisory and a low-severity prototype-pollution advisory in dev-only, CI-only tooling (markdown linting). No application runtime impact.

AI Disclosure

This PR was prepared with OpenCode AI assistance. Human review is required before merge.