Commit 46063ee
authored
fix(security): update dependency ajv to v8.18.0 [security] (#415)
This PR contains the following updates:
| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ajv](https://ajv.js.org)
([source](https://redirect.github.com/ajv-validator/ajv)) | [`8.17.1` →
`8.18.0`](https://renovatebot.com/diffs/npm/ajv/8.17.1/8.18.0) |

|

|
### GitHub Vulnerability Alerts
#### [CVE-2025-69873](https://nvd.nist.gov/vuln/detail/CVE-2025-69873)
ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable
to Regular Expression Denial of Service (ReDoS) when the `$data` option
is enabled. The pattern keyword accepts runtime data via JSON Pointer
syntax (`$data` reference), which is passed directly to the JavaScript
`RegExp()` constructor without validation. An attacker can inject a
malicious regex pattern (e.g., `\"^(a|a)*$\"`) combined with crafted
input to cause catastrophic backtracking. A 31-character payload causes
approximately 44 seconds of CPU blocking, with each additional character
doubling execution time. This enables complete denial of service with a
single HTTP request against any API using ajv with `$data`: true for
dynamic schema validation.
---
### Release Notes
<details>
<summary>ajv-validator/ajv (ajv)</summary>
###
[`v8.18.0`](https://redirect.github.com/ajv-validator/ajv/releases/tag/v8.18.0)
[Compare
Source](https://redirect.github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0)
#### What's Changed
- feat: allow tree-shaking by adding `"sideEffects": false` to
`package.json` by
[@​josdejong](https://redirect.github.com/josdejong) in
[#​2480](https://redirect.github.com/ajv-validator/ajv/pull/2480)
- fix:
[#​2482](https://redirect.github.com/ajv-validator/ajv/issues/2482)
Infinity and NaN serialise to null by
[@​jasoniangreen](https://redirect.github.com/jasoniangreen) in
[#​2487](https://redirect.github.com/ajv-validator/ajv/pull/2487)
- fix: small grammatical error in managing-schemas.md by
[@​monteiro-renato](https://redirect.github.com/monteiro-renato)
in
[#​2508](https://redirect.github.com/ajv-validator/ajv/pull/2508)
- fix: typos in schema-language.md by
[@​monteiro-renato](https://redirect.github.com/monteiro-renato)
in
[#​2507](https://redirect.github.com/ajv-validator/ajv/pull/2507)
- fix(pattern): use configured RegExp engine with $data keyword to
mitigate ReDoS attacks (CVE-2025-69873) by
[@​epoberezkin](https://redirect.github.com/epoberezkin) in
[#​2586](https://redirect.github.com/ajv-validator/ajv/pull/2586)
#### New Contributors
- [@​josdejong](https://redirect.github.com/josdejong) made their
first contribution in
[#​2480](https://redirect.github.com/ajv-validator/ajv/pull/2480)
- [@​monteiro-renato](https://redirect.github.com/monteiro-renato)
made their first contribution in
[#​2508](https://redirect.github.com/ajv-validator/ajv/pull/2508)
**Full Changelog**:
<ajv-validator/ajv@v8.17.1...v8.18.0>
</details>
---
### Configuration
📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no
schedule defined).
🚦 **Automerge**: Enabled.
♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.
🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.
---
- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box
---
This PR was generated by [Mend Renovate](https://mend.io/renovate/).
View the [repository job
log](https://developer.mend.io/github/open-feature/playground).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>1 parent f576aea commit 46063ee
1 file changed
Lines changed: 48 additions & 57 deletions
0 commit comments