build(deps): update dependencies to latest by ajanraj · Pull Request #87 · ajanraj/OpenChat

ajanraj · 2026-10-16T20:29:51Z

Summary

Several dependencies were a major version or more behind, and Dependabot's open PRs had gone stale. Shiki couldn't move on its own because @streamdown/code had to move with it. This updates everything to its latest version except three packages that are held on purpose.

Major bump	From	To
`shiki` (exact pin) + `@streamdown/code`	3.23.0 + 1.1.1	4.5.0 + 2.0.0
`katex` (every copy, see below)	0.18.11 (CSS) / 0.16.47 (renderer)	0.19.0
`motion`	12.43	14.3
`vitest` / `jsdom`	4.1 / 29.1	5.0 / 30.1
`vite-plugin-pwa`	1.3	2.0
`@composio/core`	0.22	0.25
`@tanstack/react-hotkeys`	0.10	0.14
`@convex-dev/rate-limiter`	0.3	0.4
`nitro`	3.0.260610-beta	3.0.260903-beta

Minor and patch updates cover Radix, the AI SDK, TanStack, convex 1.47, PostHog and oxlint/oxfmt. The Convex components also move to auth 0.0.96, r2, resend and stripe 0.1.7.

Held:

Package	Stays on	Why
`stripe`	22	`@convex-dev/stripe` 0.1.7 still depends on `^22` and receives the app's client and events. v23 would install two SDKs pinned to different API versions. Upstream: convex/stripe#74
`@babel/core`	7	`workbox-build` 7.4.1, used by `vite-plugin-pwa` 2, requires Babel 7. Babel 8 breaks service worker generation (see #60).
`@types/node`	24	The runtime is Node 24.x.

KaTeX fix

The app imports katex/dist/katex.css from its own katex dependency, but @streamdown/math renders math through rehype-katex with a nested KaTeX 0.16.47. Since #55 moved the app's copy to 0.17+, the two haven't matched:

KaTeX 0.17 renamed its CSS classes (base → katex-base, strut → katex-strut, the sizing classes and others). As a result, overlines and underlines disappear, and superscripts and limits render at full size.
The app's .katex-tag rule from build(deps): bump the non-major group with 53 updates #65 never matched the 0.16 markup.
The 0.16 renderer is affected by GHSA-238p-pmpm-9mq7, fixed in 0.18.2.

rehype-katex and @streamdown/math still declare katex ^0.16 (upstream: remarkjs/remark-math#121, #122). So an override points every katex at the app's version, and one patched copy does both styling and rendering:

 package.json
-"katex": "^0.18.11"            # stylesheet only
+"katex": "^0.19.0"
+"overrides": { "katex": "$katex" }   # rehype-katex, mermaid, micromark use the same copy
 markdown.test.tsx
+KaTeX stylesheet comes from the KaTeX copy that renders math
 src/types/
-streamdown-code.d.ts           # module shim; @streamdown/code 2 ships its own types, which the shim hid

rehype-katex and mermaid only call katex.renderToString with standard options (displayMode, throwOnError, strict, output). Bumping katex later moves every copy together, and the test fails if they ever split again.

Supersedes #80.

Evidence

Before (main, CI): the PWA precaches 681 entries (24,418.89 KiB). KaTeX 0.16.47 markup is styled by the 0.18 stylesheet, and bun audit lists GHSA-238p-pmpm-9mq7.
After:
- Format, lint, typecheck, 106 test files / 1,494 tests, build and bun audit all pass from a clean frozen install. The KaTeX advisory is gone.
- CI's Bun 1.3.14 installs the lockfile frozen.
- The PWA precaches 685 entries (24,773.69 KiB, +1.4%) in a local production build. Shiki 4 adds grammars, and there is one copy each of Shiki and KaTeX. The earlier Shiki-only bump in build(deps): bump shiki from 3.23.0 to 4.3.1 #58 added about 9 MiB.
KaTeX test: "KaTeX stylesheet comes from the KaTeX copy that renders math" fails with the 0.19 stylesheet over the nested 0.16 renderer (node_modules/katex vs rehype-katex/node_modules/katex) and passes with the override.
KaTeX rendering: the real remark-math → rehype-katex pipeline on 0.19, with the app's rules:
- Before: with the 0.19 stylesheet on 0.16 markup, \overline and \underline are missing and script sizes are wrong.
- After: on 0.19, both render, scripts are sized correctly, and \tag{1} is right-aligned by .katex-tag. Invalid input still falls back to the error span.
Convex: among the components, only rate-limiter's schema changes, and only additively (a pendingUpdates table and a nested batch-worker component, used only by its opt-in async mode). authTables is unchanged.
Production build in the browser: the homepage renders, Mod+B and Mod+K fire and are ignored inside the chat textbox, and the motion sidebar animation settles.
Review: two independent Codex (GPT-6.1-Sol, high) reviews of the dependency commit both approved with no findings.

Merge Danger

Door: two-way

Reverting package.json and bun.lock restores the old versions. The new rate-limiter table and batch worker stay empty unless async mode is turned on, so rolling back leaves no stranded data.

Blast Radius: app-wide

These are the behavior changes that tests don't cover. Worth a quick pass after deploy:

Math: a chat with math (fractions, \overline, superscripts, \tag), plus a mermaid diagram with math labels. Both now render with KaTeX 0.19.
Code blocks: highlighting while a response streams.
Composio: one connector chat. Since 0.23, transient tool failures go back to the model instead of being retried.
Motion animations: the sidebar, pricing cards and dialogs. In 14.2, x/y/scale animations on HTML elements moved to the compositor.
macOS hotkeys: Cmd+Shift+O, Cmd+/ and Cmd+Shift+Backspace.

Confidence Score: 5/5

The reviewed changes appear safe to merge, with no actionable new issues found.

Summary

Updates application and development dependencies, including paired upgrades to shiki and @streamdown/code.

AI chats and connected services use updated provider and backend packages.
The app’s controls, shortcuts, and animations use updated UI packages.
Markdown code blocks use the newer Shiki and Streamdown highlighter.
Markdown formulas and their stylesheet use one KaTeX version.
Build and test commands use refreshed developer tools.

No actionable new issues were established. Dependencies were not installed, and tests, builds, and browser checks were not run during this review.

_{Reviews (3) · Last reviewed commit: "fix(markdown): render math with patched ..." · Reviewed by Greptile}

Bring every dependency to its latest release, including the majors: shiki 4 with @streamdown/code 2, motion 14, vitest 5, jsdom 30, vite-plugin-pwa 2, @composio/core 0.25, @tanstack/react-hotkeys 0.14, @convex-dev/rate-limiter 0.4, katex 0.19 and the newer nitro beta. Moving shiki and @streamdown/code together keeps a single Shiki copy. @streamdown/code 2 ships its own types, so the local module shim that masked them is removed. Three packages stay on their current major: - stripe 22: @convex-dev/stripe 0.1.7 still depends on stripe ^22 and receives the app's client and events, so v23 would mean two SDKs on different API versions. - @babel/core 7: workbox-build 7.4.1 (used by vite-plugin-pwa 2) still requires Babel 7; Babel 8 breaks service worker generation. - @types/node 24: the runtime is Node 24.x.

vercel · 2026-10-16T20:29:57Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
open-chat	Ignored		Oct 16, 2026 8:46pm UTC

Copilot

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

chatgpt-codex-connector · 2026-10-16T20:29:59Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T20:47:47.796051Z	`4efbd86`	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

cubic-dev-ai

All reported issues were addressed across 3 files

_{Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic}

The app imports katex/dist/katex.css from its own katex dependency, but @streamdown/math renders math through rehype-katex with katex 0.16. KaTeX 0.17 renamed its CSS classes (base -> katex-base, strut -> katex-strut, sizing...), so since the 0.17 bump in #55 the stylesheet has not matched the markup: overlines and underlines vanish and superscripts and limits render at full size. Keep katex on the renderer's 0.16 line, which also dedupes it to one copy. A test checks both resolve to the same copy, and Dependabot ignores katex >= 0.17 so the weekly group does not re-split it.

cubic-dev-ai

All reported issues were addressed across 4 files (changes from recent commits).

_{Reply with feedback, questions, or to request a fix.

View guided diff | Turn on auto-fix | Re-trigger cubic}

The previous commit aligned the stylesheet by keeping katex on 0.16, but every 0.16 release is affected by GHSA-238p-pmpm-9mq7 (fixed in 0.18.2), and the app's .katex-tag rule (updated in #65) targets the prefixed classes that only 0.18+ emits. rehype-katex, @streamdown/math and micromark-extension-math still declare katex ^0.16 (upstream: remarkjs/remark-math#121, #122), so an override pins every katex to the app's own version. They only call katex.renderToString with standard options, which 0.17-0.19 keep. The stylesheet, the renderer and the app's KaTeX rules now share one patched copy, and the Dependabot ignore is no longer needed: bumping katex moves every copy together.

Copilot AI balanced review requested due to automatic review settings October 16, 2026 20:29

Copilot AI reviewed Oct 16, 2026

cubic-dev-ai Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread package.json

cubic-dev-ai Bot reviewed Oct 16, 2026

View reviewed changes

Comment thread .github/dependabot.yml Outdated

This was referenced Oct 16, 2026

On Vercel, the service worker is written outside the deployed output and precaches nothing #89

Open

Service worker is built but never registered #90

Open

@tailwindcss/typography pins a vulnerable postcss-selector-parser (GHSA-rj75-hqrm-r3gf) #91

Open

ajanraj merged commit 39a14d7 into main Oct 16, 2026
6 checks passed

ajanraj deleted the build/deps-october-refresh branch October 16, 2026 21:26

Navigation Menu

Repository navigation

build(deps): update dependencies to latest - #87

build(deps): update dependencies to latest#87
ajanraj merged 3 commits into
mainfrom
build/deps-october-refresh

ajanraj commented Oct 16, 2026 •

edited by greptile-apps Bot

Loading

Uh oh!

vercel Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

ajanraj commented Oct 16, 2026 • edited by greptile-apps Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

KaTeX fix

Evidence

Merge Danger

Confidence Score: 5/5

Summary

Uh oh!

vercel Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

ajanraj commented Oct 16, 2026 •

edited by greptile-apps Bot

Loading

vercel Bot commented Oct 16, 2026 •

edited

Loading

chatgpt-codex-connector Bot commented Oct 16, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading