chore(deps): bump mathlive from 0.108.2 to 0.110.0

[dependabot]

Bumps mathlive from 0.108.2 to 0.110.0.

Changelog

Sourced from mathlive's changelog.

0.110.0 2026-06-08

Security Advisories

• #3028 Fixed a cross-site scripting (XSS) vulnerability in the rendering of text-mode content. The body of \text{}, \mbox{} and similar commands accepts arbitrary characters, which were reflected unescaped into both the HTML markup (convertLatexToMarkup(), the editor, and the <math-span> / <math-div> static elements) and the MathML output (convertLatexToMathMl()). Input such as \text{<img src=x onerror=alert(1)>} could therefore execute arbitrary JavaScript when the output was inserted into the DOM. Text content and delimiters are now HTML-escaped in both output paths. Applications that render untrusted LaTeX should upgrade.

Resolved Issues

• #2949 Fixed the layout of fill-in-the-blank prompts that contain content. The prompt's outline box now correctly encloses and aligns with its content, including tall content such as fractions, with improved vertical alignment. This regression was introduced by the fix for #2515; note that #2515 (placeholders inside accent commands such as \vec{} cannot be filled) remains unresolved and is tracked separately. (contributed by @​Scienthousiaste)

• #2963 Fixed font style (variant) changes being ignored for the first character of an expression (or block). Applying a font style such as Roman Upright to the first character now serializes correctly (e.g. \mathrm{H} instead of a bare H), matching what is displayed in the mathfield. (contributed by @​psiservices-uwidmark)

• #2964 Fixed duplicate atoms accumulating when setValue() is called repeatedly with incomplete LaTeX (such as \sum_{). Partially-formed atoms that contain no content are now included when collecting atoms in a range, so they are cleared on each sync instead of accumulating across update cycles. (contributed by @​Meinzzzz)

• #3030 Fixed TypeScript 6 compilation errors (TS2882) in the published type declarations. The generated .d.ts files no longer contain bare side-effect imports (such as import '../core/modes') that referenced modules not included in the package, which TypeScript 6 flags by default via noUncheckedSideEffectImports.

Improvements

• #3032 validateLatex() now accepts an optional options argument with a macros dictionary, so custom macros are recognized during validation instead of being reported as unknown commands. (contributed by @​Wigny)

• #3009 The types for static math elements are now exported from the package

... (truncated)

Commits

• b0a4b03 0.110.0
• 5fe1c46 fixed #3028: address XSS vulnerability in text-mode content rendering
• 25db1a8 fixed #3030
• bff8a46 Merge pull request #2964 from Meinzzzz/master
• 13563e1 fix: fixed #2963
• 778967f Merge branch 'master' of https://github.com/arnog/mathlive
• 243f782 Merge pull request #3008 from psiservices-uwidmark/master
• aa77916 chore: update to CE 0.58
• a07ca15 Merge pull request #3029 from nwalters512/upgrade-compute-engine-0.58.0
• bae49ce Merge pull request #3009 from tsuji-riya/export-math-static-elements
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rtibblesbot]

🔵 Review posted

Last updated: 2026-07-31 04:30 UTC

[rtibblesbot]

PR #6058 — mathlive 0.108.2 → 0.110.0 (production dependency, package.json line 85). CI passing (frontend tests, asset build, browser smoke test, linting).

Semver: 0.x minor. Crosses the ^0.108.2 range, so breaking-eligible by convention — but the changelog across 0.108.3 → 0.110.0 lists no breaking changes, no deprecations, and no new peer dependencies. Additive only: validateLatex gains a macros option, static-math-element types exported. Studio uses neither. No code changes required.

Security fix — the main reason to take this. 0.110.0 fixes an XSS (#3028) where the body of \text{} / \mbox{} was reflected unescaped into HTML and MathML — including the editor path. Studio doesn't call convertLatexToMarkup() or use <math-span>/<math-div>, but MathNodeView.vue:11-16 renders <math-field read-only :value="node.attrs.latex"> from stored document content. Channels are collaboratively edited, so this is a real stored-XSS vector that the bump closes.

Also relevant: 0.108.3 fixes undefined is not an object (evaluating 'this.ariaLiveText.textContent=""') in Vue runtime-only builds (#2906) — Studio is one. Confirmed in the published dists: 0.108.2 accesses ariaLiveText unguarded, 0.110.0 guards both teardown and announce.

Behavioural change to know about: #2963 — a font variant applied to the first character of an expression now serializes as \mathrm{H} rather than a bare H. Correctness fix; stored LaTeX still renders, no migration needed.

Lockfile noise: the 28-minor transitive jump @cortex-js/compute-engine 0.30.2 → 0.58.0 (plus new @arnog/colors) has no bundle impact — mathlive's dist never imports compute-engine, only names it in "load this yourself" error strings, and mathlive.min.mjs grows 0.2%. Its engines: node >=21.7.3 vs Studio's 20.x pin is pre-existing (0.30.2 declared the same) and inert. react-is 19.2.7 → 19.2.8 is an unrelated dev-only float.

One manual check worth doing before merge: jest_config/jest.conf.js:21 maps mathlive to identity-obj-proxy, so no test loads the real library — green frontend tests aren't evidence of runtime compatibility. Studio's a11y workaround depends on undocumented internals (useMathLiveA11yAnnounce.js patches the textContent setter on shadowRoot.querySelector('[aria-live]'); mathLiveA11yLocalize.js regex-matches hardcoded English announcements). I diffed both against the 0.110.0 dist and they hold — shadow DOM structure byte-identical, all six English patterns present with identical occurrence counts, announcements still assigned via textContent not innerHTML — but that's read off a minified bundle. A quick pass through the formula editor with a screen reader would close it properly. Upstream #2948 is still open, so the workaround stays.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Ran a dependency-update review pipeline over the version bump:

• Classified the bump by semver (patch / minor / major) and dependency type (production vs. development)
• Extracted the changelog and release notes across the version range
• Assessed compatibility with this project's usage and whether any code changes are required
• Treated CI as the primary safety net
• Scaled the review depth to the update's risk
• Chose the verdict from semver risk, changelog findings, and CI status