Bump mathlive from 0.103.0 to 0.110.0 in /frontend

[dependabot]

Bumps mathlive from 0.103.0 to 0.110.0.

Changelog

Sourced from mathlive's changelog.

0.110.0 2026-06-08

Security Advisories

• #3028 Fixed a cross-site scripting (XSS) vulnerability in the rendering of text-mode content. The body of \text{}, \mbox{} and similar commands accepts arbitrary characters, which were reflected unescaped into both the HTML markup (convertLatexToMarkup(), the editor, and the <math-span> / <math-div> static elements) and the MathML output (convertLatexToMathMl()). Input such as \text{<img src=x onerror=alert(1)>} could therefore execute arbitrary JavaScript when the output was inserted into the DOM. Text content and delimiters are now HTML-escaped in both output paths. Applications that render untrusted LaTeX should upgrade.

Resolved Issues

• #2949 Fixed the layout of fill-in-the-blank prompts that contain content. The prompt's outline box now correctly encloses and aligns with its content, including tall content such as fractions, with improved vertical alignment. This regression was introduced by the fix for #2515; note that #2515 (placeholders inside accent commands such as \vec{} cannot be filled) remains unresolved and is tracked separately. (contributed by @​Scienthousiaste)

• #2963 Fixed font style (variant) changes being ignored for the first character of an expression (or block). Applying a font style such as Roman Upright to the first character now serializes correctly (e.g. \mathrm{H} instead of a bare H), matching what is displayed in the mathfield. (contributed by @​psiservices-uwidmark)

• #2964 Fixed duplicate atoms accumulating when setValue() is called repeatedly with incomplete LaTeX (such as \sum_{). Partially-formed atoms that contain no content are now included when collecting atoms in a range, so they are cleared on each sync instead of accumulating across update cycles. (contributed by @​Meinzzzz)

• #3030 Fixed TypeScript 6 compilation errors (TS2882) in the published type declarations. The generated .d.ts files no longer contain bare side-effect imports (such as import '../core/modes') that referenced modules not included in the package, which TypeScript 6 flags by default via noUncheckedSideEffectImports.

Improvements

• #3032 validateLatex() now accepts an optional options argument with a macros dictionary, so custom macros are recognized during validation instead of being reported as unknown commands. (contributed by @​Wigny)

• #3009 The types for static math elements are now exported from the package

... (truncated)

Commits

• b0a4b03 0.110.0
• 5fe1c46 fixed #3028: address XSS vulnerability in text-mode content rendering
• 25db1a8 fixed #3030
• bff8a46 Merge pull request #2964 from Meinzzzz/master
• 13563e1 fix: fixed #2963
• 778967f Merge branch 'master' of https://github.com/arnog/mathlive
• 243f782 Merge pull request #3008 from psiservices-uwidmark/master
• aa77916 chore: update to CE 0.58
• a07ca15 Merge pull request #3029 from nwalters512/upgrade-compute-engine-0.58.0
• bae49ce Merge pull request #3009 from tsuji-riya/export-math-static-elements
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.