Several dependencies were a major version or more behind, and Dependabot's open PRs had gone stale. Shiki couldn't move on its own because @streamdown/code had to move with it. This updates everything to its latest version except three packages that are held on purpose.
Major bump
From
To
shiki (exact pin) + @streamdown/code
3.23.0 + 1.1.1
4.5.0 + 2.0.0
katex (every copy, see below)
0.18.11 (CSS) / 0.16.47 (renderer)
0.19.0
motion
12.43
14.3
vitest / jsdom
4.1 / 29.1
5.0 / 30.1
vite-plugin-pwa
1.3
2.0
@composio/core
0.22
0.25
@tanstack/react-hotkeys
0.10
0.14
@convex-dev/rate-limiter
0.3
0.4
nitro
3.0.260610-beta
3.0.260903-beta
Minor and patch updates cover Radix, the AI SDK, TanStack, convex 1.47, PostHog and oxlint/oxfmt. The Convex components also move to auth 0.0.96, r2, resend and stripe 0.1.7.
Held:
Package
Stays on
Why
stripe
22
@convex-dev/stripe 0.1.7 still depends on ^22 and receives the app's client and events. v23 would install two SDKs pinned to different API versions. Upstream: get-convex/stripe#74
@babel/core
7
workbox-build 7.4.1, used by vite-plugin-pwa 2, requires Babel 7. Babel 8 breaks service worker generation (see #60).
@types/node
24
The runtime is Node 24.x.
KaTeX fix
The app imports katex/dist/katex.css from its own katex dependency, but @streamdown/math renders math through rehype-katex with a nested KaTeX 0.16.47. Since #55 moved the app's copy to 0.17+, the two haven't matched:
KaTeX 0.17 renamed its CSS classes (base → katex-base, strut → katex-strut, the sizing classes and others). As a result, overlines and underlines disappear, and superscripts and limits render at full size.
The app's .katex-tag rule from #65 never matched the 0.16 markup.
The 0.16 renderer is affected by GHSA-238p-pmpm-9mq7, fixed in 0.18.2.
rehype-katex and @streamdown/math still declare katex ^0.16 (upstream: remarkjs/remark-math#121, #122). So an override points every katex at the app's version, and one patched copy does both styling and rendering:
package.json
-"katex": "^0.18.11" # stylesheet only
+"katex": "^0.19.0"
+"overrides": { "katex": "$katex" } # rehype-katex, mermaid, micromark use the same copy
markdown.test.tsx
+KaTeX stylesheet comes from the KaTeX copy that renders math
src/types/
-streamdown-code.d.ts # module shim; @streamdown/code 2 ships its own types, which the shim hid
rehype-katex and mermaid only call katex.renderToString with standard options (displayMode, throwOnError, strict, output). Bumping katex later moves every copy together, and the test fails if they ever split again.
Before (main, CI): the PWA precaches 681 entries (24,418.89 KiB). KaTeX 0.16.47 markup is styled by the 0.18 stylesheet, and bun audit lists GHSA-238p-pmpm-9mq7. After:
Format, lint, typecheck, 106 test files / 1,494 tests, build and bun audit all pass from a clean frozen install. The KaTeX advisory is gone.
CI's Bun 1.3.14 installs the lockfile frozen.
The PWA precaches 685 entries (24,773.69 KiB, +1.4%) in a local production build. Shiki 4 adds grammars, and there is one copy each of Shiki and KaTeX. The earlier Shiki-only bump in #58 added about 9 MiB.
KaTeX test: "KaTeX stylesheet comes from the KaTeX copy that renders math" fails with the 0.19 stylesheet over the nested 0.16 renderer (node_modules/katex vs rehype-katex/node_modules/katex) and passes with the override.
KaTeX rendering: the real remark-math → rehype-katex pipeline on 0.19, with the app's rules:
Before: with the 0.19 stylesheet on 0.16 markup, \overline and \underline are missing and script sizes are wrong.
After: on 0.19, both render, scripts are sized correctly, and \tag{1} is right-aligned by .katex-tag. Invalid input still falls back to the error span.
Convex: among the components, only rate-limiter's schema changes, and only additively (a pendingUpdates table and a nested batch-worker component, used only by its opt-in async mode). authTables is unchanged.
Production build in the browser: the homepage renders, Mod+B and Mod+K fire and are ignored inside the chat textbox, and the motion sidebar animation settles.
Review: two independent Codex (GPT-6.1-Sol, high) reviews of the dependency commit both approved with no findings.
Merge Danger
Door: two-way
Reverting package.json and bun.lock restores the old versions. The new rate-limiter table and batch worker stay empty unless async mode is turned on, so rolling back leaves no stranded data.
Blast Radius: app-wide
These are the behavior changes that tests don't cover. Worth a quick pass after deploy:
Math: a chat with math (fractions, \overline, superscripts, \tag), plus a mermaid diagram with math labels. Both now render with KaTeX 0.19.
Code blocks: highlighting while a response streams.
Composio: one connector chat. Since 0.23, transient tool failures go back to the model instead of being retried.
Motion animations: the sidebar, pricing cards and dialogs. In 14.2, x/y/scale animations on HTML elements moved to the compositor.
macOS hotkeys: Cmd+Shift+O, Cmd+/ and Cmd+Shift+Backspace.
Confidence Score: 5/5
The reviewed changes appear safe to merge, with no actionable new issues found.
Summary
Updates application and development dependencies, including paired upgrades to shiki and @streamdown/code.
AI chats and connected services use updated provider and backend packages.
The app’s controls, shortcuts, and animations use updated UI packages.
Markdown code blocks use the newer Shiki and Streamdown highlighter.
Markdown formulas and their stylesheet use one KaTeX version.
Build and test commands use refreshed developer tools.
No actionable new issues were established. Dependencies were not installed, and tests, builds, and browser checks were not run during this review.
