fix: patch dependency advisories and upgrade streamdown to 2.7

[chenyme]

Summary

Clears the open Dependabot advisories that have a fix available. Also upgrades Streamdown to 2.7 and gives Mermaid diagrams one consistent loading state.

Backend: excelize (Remote DoS via crafted .xlsx)

• Bump github.com/xuri/excelize/v2 from v2.11.0 to v2.11.1-0.20261009041834-958cda5363be. No tagged release includes the fixes yet. This master commit is newer than every fix commit in the 18 published advisories, which cover Zip64 overflow in OpenReader, decrypt panics, unbounded allocation in extractPart / Rows.Columns, ColumnNameToNumber overflow and spinCount CPU burn.
• Add a panic guard in extraction.extractLocalFile. Upload processing runs extraction in a bare goroutine with no recover. Before this change, a parser panic on a malformed file crashed the whole process. Now it becomes extract_failed (ErrParserPanicked) for that file only. The guard covers every built-in parser (XLSX/XLS/PDF/Word). It is defense in depth: it cannot stop infinite loops or OOM, which is why the version bump is still needed.
• Transitive updates: golang.org/x/{crypto,net,sync,text,sys,mod}, xuri/efp, richardlehane/mscfb. go mod tidy also fixed existing drift: mattn/go-sqlite3 is now listed as a direct dependency (it is imported by dberror/gorm.go).

Backend: OpenTelemetry

• Bump go.opentelemetry.io/otel, sdk, trace, otlptracegrpc, otlptracehttp from v1.44.0 to v1.45.0, the lowest version that fixes all three advisories (attribute truncation, endpoint URL leaking into logs, BSD kenv PATH hijack). We did not go to 1.47, because it pulls in unrelated upgrades (quic-go, mongo-driver). otelgin / otelhttp stay at v0.69.0.

Frontend: KaTeX

• Bump katex from ^0.16.45 to ^0.18.11, and add a root pnpm.overrides entry for katex. rehype-katex, @streamdown/math, mermaid and micromark-extension-math all depend on katex ^0.16. Without the override, a second vulnerable copy (0.16.47) would stay in the lockfile, and the CSS version would not match the rendered HTML. The lockfile now resolves to a single katex@0.18.11.
• KaTeX 0.18 renamed some span classes (base → katex-base, strut → katex-strut, sizing → katex-sizing). KATEX_SPAN_CLASS_NAMES in streamdown-html.tsx now uses the new names, so the style sanitizer still recognises KaTeX output.

Frontend: Streamdown 2.7

• streamdown ^2.6.0 → ^2.7.0, @streamdown/code ^1.1.1 → ^2.0.0 (Shiki 4, requires Node >= 20; CI and Docker use Node 24), @streamdown/math / mermaid / cjk → latest patch.
• What we get from the upgrade: a < inside math no longer cuts off a streaming message; bare URLs after CJK full-width punctuation are now auto-linked; better repair of half-streamed markdown (remend 1.4); incremental highlighting and block reuse while streaming.
• Compatibility changes:
  • remend now rewrites a half-streamed image to streamdown:incomplete-image instead of dropping it. MarkdownImage shows the existing pulse skeleton for that src, so the browser does not try to load an invalid URL.
  • Streamdown 2.7 now sizes Mermaid diagrams to fit the pan-zoom viewport. We removed our <svg> size overrides and moved the 280px cap onto the viewport, so diagrams are no longer shrunk twice or clipped.

Frontend: Mermaid loading UI

• Before a diagram rendered, users used to see several states in a row: raw source while the plugin downloaded, Streamdown's bordered skeleton, a blank 200px area, a hard-coded English "Loading diagram...", and a red parse error on every token while the chart streamed. These are replaced by one placeholder (MarkdownMermaidLoading, in the new streamdown-mermaid.tsx): a soft dotted canvas with a shimmering, localised "Rendering diagram…" label.
• Streamdown's own placeholders stay in the layout but are hidden with CSS :has(). They must stay laid out because its deferred render waits for an IntersectionObserver signal. Browsers without :has() fall back to Streamdown's default placeholders.
• While a chart is still streaming, parse errors are suppressed. After it finishes, a real failure shows a localised error card with the error message, a Retry button and a collapsible "View source".
• If the Mermaid plugin fails to download, the fence is shown as a normal code block instead of loading forever.
• Fixed an existing issue: when a streamed answer gained a new feature (for example a code fence after a diagram), the plugin set was reset. That unmounted the rendered diagram and rendered it again. Already loaded code / mermaid plugins are now kept while the new set loads.

Not addressed

• glib (RUSTSEC-2024-0429, desktop only): the dependency chain tauri → wry → webkit2gtk pins the GTK3 bindings to glib 0.18, and the fix is only in 0.20. We do not use the affected VariantStrIter API. Recommend dismissing the alert as "vulnerable code is not used".

Change type

• Bug fix
• Feature
• Documentation
• Refactor
• Configuration / deployment
• Security hardening
• Other

Affected areas

• Frontend / UI
• Backend / API
• Authentication / authorization
• Conversations / streaming
• Files / RAG / extraction
• Model routing / providers
• MCP / tools
• Billing / payments
• Admin console
• Deployment / Docker / configuration
• Documentation

Verification

• Backend: go build ./..., make lint, go test ./.... New test: TestExtractionRecoversParserPanicAsExtractFailure.
• Frontend: pnpm typecheck, pnpm check:arch, biome lint shared/components/markdown.
• Checked in Node: remend output for an incomplete image and for < inside math; rehype-katex with KaTeX 0.18.11 emits katex-base / katex-strut.
• Manual browser check (see below).

Manual checks:

• Math: inline, block, fractions and roots render correctly after the KaTeX bump.
• Code highlighting under Shiki 4, light and dark themes.
• Mermaid: first load, a diagram while it streams, a broken chart (error card, Retry, View source), dark mode, the action buttons in the top-right corner, and the 280px height cap.
• A half-streamed image shows the skeleton instead of a broken image.

Screenshots, API examples, or logs

Configuration, migration, and compatibility notes

• No database, config or API contract changes.
• @streamdown/code@2 requires Node >= 20 (already met by CI and Docker).
• pnpm.overrides now pins katex to ^0.18.11 for the whole workspace. Remove the override once upstream packages accept KaTeX 0.18.
• excelize is pinned to a master pseudo-version. Move to the next tagged release once one ships.
• New i18n keys: chat.markdown.diagram.{rendering,renderFailed,viewSource} (zh-CN and en-US).

Documentation

• Documentation is not needed for this change.
• Documentation was updated.
• Documentation still needs to be updated.

Security and privacy

• No secrets, tokens, credentials, local config, or personal data are included.
• User data access remains scoped by authenticated user context unless an admin-only path explicitly requires broader access.
• Security-sensitive behavior was reviewed, including authentication, authorization, provider routing, file processing, billing, and admin APIs where relevant.

Checklist

• I searched existing issues and pull requests.
• Changes are focused and do not include unrelated refactors.
• Tests or static verification were run where practical.
• User-facing behavior, deployment steps, API contracts, or configuration changes are documented.
• Generated artifacts are included only when this project explicitly requires them.
• Caches, build output, .pyc files, .env files, and local storage data are not committed.