Merged
Conversation
- Bump all 7 @myst-theme/* packages from ^0.14.0 to ^1.1.2 - Bump myst-to-react from ^0.14.0 to ^1.1.2 - Bump myst-common and myst-config from ^1.7.9 to ^1.8.1 - Remove cytoscape override (mermaid upgraded from 9.x to 11.x) - Retain prismjs and katex overrides for security Breaking change in myst-theme v1.0.0: New AST structure for notebook output nodes (PR jupyter-book/myst-theme#571). Downstream lecture sites must rebuild content with compatible mystmd version.
There was a problem hiding this comment.
Pull request overview
This PR upgrades the @myst-theme/* package family from version 0.14.x to 1.1.2, along with related myst-* dependencies, to align with the upstream myst-theme/book template. The upgrade addresses security vulnerabilities and removes an unnecessary cytoscape override that was required for mermaid 9.x compatibility.
Changes:
- Upgraded seven
@myst-theme/*packages from^0.14.0to^1.1.2 - Upgraded three
myst-*packages (myst-common,myst-config,myst-to-react) to their latest versions - Removed the
cytoscapeoverride as mermaid's upgrade to 11.x makes it unnecessary
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
mmcky
added a commit
that referenced
this pull request
Feb 25, 2026
mmcky
added a commit
that referenced
this pull request
Feb 25, 2026
mmcky
added a commit
that referenced
this pull request
Feb 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upgrades all
@myst-theme/*packages from 0.14.x to 1.1.2, along with relatedmyst-*dependencies. This aligns quantecon-theme-src with the upstream myst-theme/book template.Changes
Package Bumps
@myst-theme/common^0.14.0^1.1.2@myst-theme/icons^0.14.0^1.1.2@myst-theme/jupyter^0.14.0^1.1.2@myst-theme/providers^0.14.0^1.1.2@myst-theme/search-minisearch^0.14.0^1.1.2@myst-theme/site^0.14.0^1.1.2@myst-theme/styles^0.14.0^1.1.2myst-to-react^0.14.0^1.1.2myst-common^1.7.9^1.8.1myst-config^1.7.9^1.8.1Other Changes
cytoscapeoverride — no longer needed since mermaid upgraded from 9.x → 11.x (compatible with latest cytoscape)prismjsandkatexoverrides — still needed for security (transitive deps don't declare safe minimums)Security Impact
Reduces npm audit findings from 37 → 34 (3 additional vulns fixed upstream: dompurify, mermaid/prismjs chain)
Breaking Change (upstream)
@myst-themev1.0.0 introduced a new AST structure for notebook output nodes (jupyter-book/myst-theme#571). This change is not backwards compatible — downstream lecture sites must rebuild content with a compatiblemystmdversion. The theme code itself requires no changes.Key Compatibility Notes
@remix-run/node@^1.19Ecosystem Alignment
Surveyed all projects in the myst-theme ecosystem to confirm this is the right upgrade path:
~1.19.0~1.17.0^1.19.3^1.1.2^1.1.2^0.13.3^2.15.1^2.15.1^2.15.9npm@8.10.0npm@8.10.0npm@8.10.0No project in the myst ecosystem has migrated to Remix v2. All use Remix v1 with v2 future flags enabled. The remaining 34 npm audit findings are ecosystem-wide — they affect every myst-theme consumer equally and are blocked by:
@remix-run/vercelwas deprecated in v2, needs@vercel/remixreplacement. Tracked in Migrate from Remix v1 to v2 #28.Testing
npm install✅npm run prod:build✅ (14.6s, only pre-existing@myst-theme/site/srcdeep-import warning)npm audit: 34 remaining vulnerabilities (all ecosystem-wide, require upstream breaking changes)