chore(deps): refresh postcss, markdown-it, and linkify-it

[jasonworden]

Refreshes postcss, markdown-it, and linkify-it in pnpm-lock.yaml, clearing five open Dependabot alerts across the three packages.

Alerts cleared

Alert	Severity	Package	Advisory
#28	High	postcss	GHSA-r28c-9q8g-f849 — vulnerable range <= 8.5.17
#25	High	linkify-it	GHSA-v245-v573-v5vm — vulnerable range <= 5.0.1
#42	Medium	postcss	GHSA-fxqj-rqcc-2cmp — vulnerable range <= 8.5.22
#11	Medium	markdown-it	GHSA-38c4-r59v-3vqw — vulnerable range >= 13.0.0, < 14.1.1
#12	Medium	markdown-it	GHSA-6v5v-wf23-fmfq — vulnerable range <= 14.1.1

Resolutions

Package	Before	After
postcss	8.5.15	8.5.26
markdown-it	14.1.0, 14.2.0, 14.3.0	14.3.0
linkify-it	5.0.1, 5.0.2	5.0.2

Only markdown-it@14.1.0 and linkify-it@5.0.1 were the vulnerable copies; the higher duplicates were already clean. Deduplicating them is what makes the lockfile diff net negative — 11 insertions, 44 deletions.

Why a lockfile refresh is the whole fix

Every parent's declared range already admitted the patched version, so the lockfile was simply stale:

Vulnerable copy	Reached via	Parent declares	Admits patched?
postcss@8.5.15	vite@6.4.3	^8.5.3	yes
markdown-it@14.1.0	@vscode/vsce@3.9.2	^14.1.0	yes
linkify-it@5.0.1	markdown-it@14.1.0 / @14.2.0	^5.0.0 / ^5.0.1	yes

pnpm update postcss linkify-it markdown-it -r resolves all three. No manifest range bump is needed — unlike #177, none of these is a direct dependencies entry of a published package, so there is no declared floor of ours to raise.

Why not an overrides: entry

pnpm-workspace.yaml has no overrides: block (verified on 75b0dd7: it holds only packages:, verifyDepsBeforeRun:, catalog:, allowBuilds:), and adding one would change nothing. An override exists to force a resolution the declared ranges would otherwise forbid; here every range already permits the patched version and the lock now lands there on its own. An override would be an inert pin that masks future range drift. None added.

catalog: is likewise not a lever here — it reaches only direct deps, and none of these three appears in any workspace manifest.

Exposure

Dev-only — nothing published reaches any of the three. Every path terminates in a devDependencies edge:

postcss@8.5.26
└─ vite@6.4.3 → vitest@4.1.9 → mermaid-lint (devDependencies)
                             └ @mermaid-lint/vitest@0.50.0 (devDependencies)

markdown-it@14.3.0            (linkify-it@5.0.2 sits under this same node)
├─ @vscode/vsce@3.9.2      → mermaid-lint-vscode@0.14.0 (devDependencies)
├─ markdownlint-cli2@0.23.2 → @mermaid-lint/markdownlint@0.50.0 (devDependencies)
└─ typedoc@0.28.19          → @mermaid-lint/core@0.50.0 (devDependencies)

The consumers are the test runner (vite/vitest), the VS Code extension's packaging tool (vsce), the markdown linter used on this repo's own docs, and the API-docs generator. The published packages ship files: ["dist", "src", "index.ts"] (core) / ["dist", "index.ts"] and never include the lockfile, so no downstream install resolves any of these.

This is the #176 shape, not the #177 shape: no consumer-facing surface, therefore no manifest edit.

No version bump

No packages/*/package.json is touched, so release.yml does not even trigger. Consistent with #107, #174, and #176.

Verification

• pnpm test — 54 files, 1231 tests passing
• pnpm lint — clean (145 files)
• pnpm --filter @mermaid-lint/jest test — 3 tests passing
• pnpm --filter mermaid-lint-vscode package — VSIX builds clean, exercising vsce end to end against the bumped markdown-it
• pnpm why — one resolved version each of postcss, markdown-it, and linkify-it
• Diff is pnpm-lock.yaml only, net −33 lines

🤖 Generated with Claude Code