Skip to content

Update ajv to v8 - #768

Open
vsulak wants to merge 2 commits into
feathersjs-ecosystem:masterfrom
vsulak:update-ajv-to-v8
Open

Update ajv to v8#768
vsulak wants to merge 2 commits into
feathersjs-ecosystem:masterfrom
vsulak:update-ajv-to-v8

Conversation

@vsulak

@vsulak vsulak commented Feb 18, 2026

Copy link
Copy Markdown

Summary

There is new security finding in ajv that is not simply fixable by updating of deep dependencies. For this package, this is breaking change. Therefore it was necessary to edit the code using ajv and its test to reflect new ajv output.

This PR also fixes another vulnerability - bugfix update of lodash.

I don't see any issue related to this PR.

This PR is not dependant on other PRs.

Other Information

NPM audit of production dependencies

npm audit --package-lock-only --omit=dev
# npm audit report

ajv  <8.18.0
Severity: moderate
ajv has ReDoS when using `$data` option - https://github.com/advisories/GHSA-2g4f-4pwh-qvx6
fix available via `npm audit fix --force`
Will install ajv@8.18.0, which is a breaking change
node_modules/ajv

lodash  4.0.0 - 4.17.21
Severity: moderate
Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions - https://github.com/advisories/GHSA-xxjr-mmjv-4gpg
fix available via `npm audit fix`
node_modules/lodash

2 moderate severity vulnerabilities

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@vsulak