Skip to content

fix(deps): upgrade ajv from v6 to v8 to resolve ReDoS vulnerability#977

Open
cryptodev-2s wants to merge 1 commit intoopen-rpc:masterfrom
cryptodev-2s:fix/upgrade-ajv-v8
Open

fix(deps): upgrade ajv from v6 to v8 to resolve ReDoS vulnerability#977
cryptodev-2s wants to merge 1 commit intoopen-rpc:masterfrom
cryptodev-2s:fix/upgrade-ajv-v8

Conversation

@cryptodev-2s
Copy link

Summary

  • Upgrade ajv from ^6.10.0 to ^8.18.0 to fix moderate severity ReDoS vulnerability GHSA-2g4f-4pwh-qvx6
  • Add ajv-formats@^3.0.1 (formats were extracted to a separate package in v8)
  • Update type imports and test mocks for v8 compatibility

Changes

File Change
package.json ajv ^6.10.0^8.18.0, add ajv-formats
validate-open-rpc-document.ts Add addFormats(), set strict: false (needed for draft-07 style additionalItems in @json-schema-tools/meta-schema)
method-call-validator.ts Update Ajv as IAjvAjv (v8 type export), add addFormats()
parameter-validation-error.test.ts dataPathinstancePath in mock ErrorObject

Breaking change

ErrorObject.dataPath was renamed to ErrorObject.instancePath in ajv v8. Downstream code accessing error object properties directly will need to update.

Test plan

  • All 79 unit tests pass
  • TypeScript compiles clean
  • Webpack web build succeeds
  • 100% line coverage maintained

BREAKING CHANGE: `ErrorObject.dataPath` is renamed to `ErrorObject.instancePath` in ajv v8
@codecov
Copy link

codecov bot commented Feb 17, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (de3dca3) to head (cfc719b).

Additional details and impacted files
@@            Coverage Diff            @@
##            master      #977   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           16        16           
  Lines          528       532    +4     
  Branches       136       136           
=========================================
+ Hits           528       532    +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant