fix(deps): update transitive KaTeX

[zkoppert]

Why

I upgraded the single affected dependency to KaTeX 0.18.10, above the patched minimum of 0.18.2.

What changed

I added an npm override scoped to micromark-extension-math and regenerated the lockfile. The update also moves KaTeX's Commander dependency to 15.0.0, which requires Node.js 22.12.0 or later.

Behavior	Before	After
Resolved KaTeX version	0.16.47	0.18.10
Inherited trust setting	Can enable unsafe links and resource loading	Ignored; explicit trust settings still work
Normal inline and display math	Renders	Still renders

Tradeoffs

I chose a scoped override because micromark-extension-math still requires KaTeX ^0.16.0. I kept unrelated dependency updates outside this fix.

Testing

I verified the fix locally on Node.js 26.8.2 with clean dependency installs and real KaTeX and micromark rendering.

• I checked inline and display math, explicit trust policies, expansion limits, and command-line rendering.
• I reproduced unsafe link execution and an untrusted image request to a local test server on the baseline. The patched version blocked both.
• I checked inherited settings, setting metadata, and macro restoration against the patched renderer.
• I confirmed that the npm audit result no longer includes KaTeX. Six unrelated audit findings remain.

Rollout

The dependency is development-only, so no application rollout or feature flag is needed.

I'll watch the CI workflow for dependency installation or Markdown tooling regressions. After merge, I'll check whether Dependabot closes the affected alert.

[Copilot]

🔵 Needs a closer look

The override exceeds the parent dependency’s declared KaTeX compatibility range, so human confirmation is needed despite the reported validation.

No open issues 🎉

What changed in this PR

Updates development-only Markdown tooling dependencies to address CVE-2026-103923 in KaTeX.

Changes:

• Adds a KaTeX override scoped to micromark-extension-math.
• Locks KaTeX to 0.18.10 and Commander to 15.0.0, requiring Node.js 22.12.0 or later.

File	Description
package.json	Adds the scoped KaTeX override.
package-lock.json	Records updated KaTeX and Commander dependencies.

_{Review effort: Max}