Merge branch 'stoplightio:master' into master

aschereT · web-flow · commit 38219fbc9b7c · 2025-11-03T16:22:38.000-08:00
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
@@ -0,0 +1,125 @@
+name: stoplightio/prism/build
+on:
+  push:
+    branches:
+    - master
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    container:
+      image: node:18.20
+    steps:
+    - uses: actions/checkout@v4.1.0
+    - name: restore_cache
+      uses: actions/cache@v3.3.2
+      with:
+        key: yarn-packages-{{ .Branch }}-{{ checksum "yarn.lock" }}
+        path: node_modules/
+        restore-keys: yarn-packages-{{ .Branch }}-{{ checksum "yarn.lock" }}
+    - name: Install Dependencies
+      run: yarn --frozen-lockfile
+    - name: Lint the codebase
+      run: yarn lint
+    - name: Run tests
+      run: yarn test --colors --maxWorkers=2
+    - name: Run build
+      run: yarn build
+  harness-macos:
+    if: (github.ref == 'refs/tags/"v[0-9].[0-9]+.[0-9]+"') && (github.ref != 'refs/heads/master')
+    runs-on: macos-latest
+    env:
+      executor: macos
+      install_manually: true
+    steps:
+    - uses: maxim-lobanov/setup-xcode@v1.6.0
+      with:
+        xcode-version: 13.4.1
+    - uses: actions/checkout@v4.1.0
+    - run: nvm install 18.20.1 && nvm alias default 18.20.1
+      if: env.install_manually
+    - run: pip3 install pipenv gunicorn
+      if: env.install_manually
+    - run: sudo bash -c 'echo "0.0.0.0 httpbin.org" >> /etc/hosts'
+      if: env.install_manually
+    - run: git clone https://github.com/stoplightio/httpbin httpbin
+      if: env.install_manually
+    - run: cd httpbin && pip3 install --no-cache-dir -r <(pipenv requirements) && pip3 install --no-cache-dir ./
+      if: env.install_manually
+    - run: cd httpbin && gunicorn -b 0.0.0.0:80 httpbin:app -k gevent
+      if: env.install_manually
+    - name: Install Dependencies
+      run: yarn --frozen-lockfile
+    - name: Create CLI binary
+      run: yarn build.binary
+    - name: Run Harness
+      run: yarn test.harness
+  harness-docker:
+    runs-on: ubuntu-latest
+    container:
+      image: node:18.20
+    env:
+      executor: docker-harness
+      install_manually: true
+    steps:
+    - uses: actions/checkout@v4.1.0
+    - run: nvm install 18.20.1 && nvm alias default 18.20.1
+      if: env.install_manually
+    - run: pip3 install pipenv gunicorn
+      if: env.install_manually
+    - run: sudo bash -c 'echo "0.0.0.0 httpbin.org" >> /etc/hosts'
+      if: env.install_manually
+    - run: git clone REDACTED://github.com/stoplightio/httpbin httpbin
+      if: env.install_manually
+    - run: cd httpbin && pip3 install --no-cache-dir -r <(pipenv requirements) && pip3 install --no-cache-dir ./
+      if: env.install_manually
+    - run: cd httpbin && gunicorn -b 0.0.0.0:80 httpbin:app -k gevent
+      if: env.install_manually
+    - name: Install Dependencies
+      run: yarn --frozen-lockfile
+    - name: Create CLI binary
+      run: yarn build.binary
+    - name: Run Harness
+      run: yarn test.harness
+  publish:
+    if: (github.ref == 'refs/tags/"v[0-9].[0-9]+.[0-9]+"') && (github.ref != 'refs/heads/master')
+    runs-on: ubuntu-latest
+    container:
+      image: node:18.20
+    needs:
+    - build
+    - harness-macos
+    - harness-docker
+    steps:
+    - uses: actions/checkout@v4.1.0
+    - name: Set git identity
+      run: git config user.email "circle@circleci.com" && git config user.name "circleci"
+    - name: Install Dependencies
+      run: yarn --frozen-lockfile
+    - name: Build all code to JavaScript
+      run: yarn build
+    - run: echo "//registry.npmjs.org/:_authToken=${{ secrets.NPM_TOKEN }}" >> ~/.npmrc
+    - name: Publish
+      run: yarn lerna publish from-git --create-release=github --yes
+    - name: Create CLI binaries
+      run: npx pkg --out-path ./cli-binaries ./packages/cli/
+    - uses: actions/upload-artifact@v4.1.0
+      with:
+        path: "./cli-binaries"
+    - uses: actions/upload-artifact@v4.1.0
+      with:
+        path: ".//cli-binaries"
+  upload_artifacts:
+    if: (github.ref == 'refs/tags/"v[0-9].[0-9]+.[0-9]+"') && (github.ref != 'refs/heads/master')
+    runs-on: ubuntu-latest
+    container:
+      image: golang:1.23
+    needs:
+    - publish
+    steps:
+    - uses: actions/download-artifact@v4.1.0
+      with:
+        path: "/tmp/"
+    - name: Download GitHub Release Utility
+      run: go install github.com/tcnksm/ghr@latest
+    - name: Publish Release artifacts on GitHub
+      run: ghr -t ${{github.token}} -u ${{ github.actor }} -r ${{ github.repository }} -c ${{ github.sha }} ${{ github.ref }} /tmp/cli-binaries
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
@@ -1,7 +1,7 @@
 {
-  ".": "5.14.2",
-  "packages/cli": "5.14.2",
+  ".": "5.14.3",
+  "packages/cli": "5.14.3",
   "packages/core": "5.8.0",
   "packages/http": "5.12.1",
-  "packages/http-server": "5.12.2"
-}
+  "packages/http-server": "5.13.0"
+}
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -16,6 +16,13 @@ The format for this file is based on [Keep a Changelog](https://keepachangelog.c
 
 <!-- markdown-link-check-disable -->
 
+## [5.14.3](https://github.com/stoplightio/prism/compare/v5.14.2...v5.14.3) (2025-10-27)
+
+
+### Bug Fixes
+
+* Fix vulnerability CVE-2025-1302 ([#2702](https://github.com/stoplightio/prism/issues/2702)) ([fdc55de](https://github.com/stoplightio/prism/commit/fdc55de8742ac1f47ac32a69700406a71774cd29))
+
 ## [5.14.2](https://github.com/stoplightio/prism/compare/v5.14.1...v5.14.2) (2025-04-17)
 
 
diff --git a/package.json b/package.json
@@ -23,7 +23,7 @@
   },
   "resolutions": {
     "sanitize-html": "2.12.1",
-    "jsonpath-plus":"10.2.0"
+    "jsonpath-plus": "10.3.0"
   },
   "devDependencies": {
     "@stoplight/types": "^14.1.0",
diff --git a/packages/cli/CHANGELOG.md b/packages/cli/CHANGELOG.md
@@ -1,5 +1,14 @@
 # Changelog
 
+## [5.14.3](https://github.com/stoplightio/prism/compare/v5.14.2...v5.14.3) (2025-10-27)
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @stoplight/prism-http-server bumped from ^5.12.0 to ^5.13.0
+
 ## [5.14.2](https://github.com/stoplightio/prism/compare/v5.14.1...v5.14.2) (2025-04-17)
 
 
diff --git a/packages/cli/package.json b/packages/cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stoplight/prism-cli",
-  "version": "5.14.2",
+  "version": "5.14.3",
   "author": "Stoplight <support@stoplight.io>",
   "bin": {
     "prism": "./dist/index.js"
@@ -11,7 +11,7 @@
     "@stoplight/json-schema-ref-parser": "9.2.7",
     "@stoplight/prism-core": "^5.8.0",
     "@stoplight/prism-http": "5.12.0",
-    "@stoplight/prism-http-server": "^5.12.0",
+    "@stoplight/prism-http-server": "^5.13.0",
     "@stoplight/types": "^14.1.0",
     "chalk": "^4.1.2",
     "chokidar": "^3.5.2",
diff --git a/packages/http-server/package.json b/packages/http-server/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@stoplight/prism-http-server",
-  "version": "5.12.2",
+  "version": "5.13.0",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "author": "Stoplight <support@stoplight.io>",
diff --git a/version.txt b/version.txt
@@ -1 +1 @@
-5.14.2
+5.14.3

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@stoplight/prism-http-server",`
`3`		`- "version": "5.12.2",`
	`3`	`+ "version": "5.13.0",`
`4`	`4`	`"main": "dist/index.js",`
`5`	`5`	`"types": "dist/index.d.ts",`
`6`	`6`	`"author": "Stoplight <[email protected]>",`