Bump the npm_and_yarn group across 1 directory with 4 updates

[dependabot]

Bumps the npm_and_yarn group with 4 updates in the / directory: mathlive, brace-expansion, js-yaml and postcss.

Updates mathlive from 0.104.2 to 0.110.0

Changelog

Sourced from mathlive's changelog.

0.110.0 2026-06-08

Security Advisories

• #3028 Fixed a cross-site scripting (XSS) vulnerability in the rendering of text-mode content. The body of \text{}, \mbox{} and similar commands accepts arbitrary characters, which were reflected unescaped into both the HTML markup (convertLatexToMarkup(), the editor, and the <math-span> / <math-div> static elements) and the MathML output (convertLatexToMathMl()). Input such as \text{<img src=x onerror=alert(1)>} could therefore execute arbitrary JavaScript when the output was inserted into the DOM. Text content and delimiters are now HTML-escaped in both output paths. Applications that render untrusted LaTeX should upgrade.

Resolved Issues

• #2949 Fixed the layout of fill-in-the-blank prompts that contain content. The prompt's outline box now correctly encloses and aligns with its content, including tall content such as fractions, with improved vertical alignment. This regression was introduced by the fix for #2515; note that #2515 (placeholders inside accent commands such as \vec{} cannot be filled) remains unresolved and is tracked separately. (contributed by @​Scienthousiaste)

• #2963 Fixed font style (variant) changes being ignored for the first character of an expression (or block). Applying a font style such as Roman Upright to the first character now serializes correctly (e.g. \mathrm{H} instead of a bare H), matching what is displayed in the mathfield. (contributed by @​psiservices-uwidmark)

• #2964 Fixed duplicate atoms accumulating when setValue() is called repeatedly with incomplete LaTeX (such as \sum_{). Partially-formed atoms that contain no content are now included when collecting atoms in a range, so they are cleared on each sync instead of accumulating across update cycles. (contributed by @​Meinzzzz)

• #3030 Fixed TypeScript 6 compilation errors (TS2882) in the published type declarations. The generated .d.ts files no longer contain bare side-effect imports (such as import '../core/modes') that referenced modules not included in the package, which TypeScript 6 flags by default via noUncheckedSideEffectImports.

Improvements

• #3032 validateLatex() now accepts an optional options argument with a macros dictionary, so custom macros are recognized during validation instead of being reported as unknown commands. (contributed by @​Wigny)

• #3009 The types for static math elements are now exported from the package

... (truncated)

Commits

• b0a4b03 0.110.0
• 5fe1c46 fixed #3028: address XSS vulnerability in text-mode content rendering
• 25db1a8 fixed #3030
• bff8a46 Merge pull request #2964 from Meinzzzz/master
• 13563e1 fix: fixed #2963
• 778967f Merge branch 'master' of https://github.com/arnog/mathlive
• 243f782 Merge pull request #3008 from psiservices-uwidmark/master
• aa77916 chore: update to CE 0.58
• a07ca15 Merge pull request #3029 from nwalters512/upgrade-compute-engine-0.58.0
• bae49ce Merge pull request #3009 from tsuji-riya/export-math-static-elements
• Additional commits viewable in compare view

Updates brace-expansion from 1.1.16 to 1.1.18

Commits

• 758fcd6 1.1.18
• 27fbeed Merge commit from fork
• 5c57cc2 1.1.17
• d757f1d npm ignore .claude
• cb4b9e4 fix: backport GHSA-mh99-v99m-4gvg (#129)
• See full diff in compare view

Updates js-yaml from 4.3.0 to 4.3.1

Changelog

Sourced from js-yaml's changelog.

4.3.1 - 2026-07-31

Security

• [backport] Remove quadratic complexity from !!omap duplicate key detection.

Commits

• 86e91b8 4.3.1 released
• c3cc4b0 Backport quadratic complexity fix for !!omap
• See full diff in compare view

Updates postcss from 8.5.22 to 8.5.26

Release notes

Sourced from postcss's releases.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

Changelog

Sourced from postcss's changelog.

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

Commits

• 07b2577 Release 8.5.26 version
• 47de6b9 Update CI
• 1493a83 Fix Rule#selectors losing the empty selector (#2129)
• 180db16 Typo
• 29e9e00 Resolve symlinks before the previous-source-map containment check (#2125)
• 3ba8f84 Update dependencies
• 87e72f6 Update lock file
• caaeeb9 Upgrade nanoid to fix infinite loop on zero size (#2124)
• 3609b6f Explain how to type plugin options
• fbad419 docs: show ESM and TypeScript plugin declaration (#2118)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.