Skip to content

Commit 46063ee

Browse files
fix(security): update dependency ajv to v8.18.0 [security] (#415)
This PR contains the following updates: | Package | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | |---|---|---|---| | [ajv](https://ajv.js.org) ([source](https://redirect.github.com/ajv-validator/ajv)) | [`8.17.1` → `8.18.0`](https://renovatebot.com/diffs/npm/ajv/8.17.1/8.18.0) | ![age](https://developer.mend.io/api/mc/badges/age/npm/ajv/8.18.0?slim=true) | ![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ajv/8.17.1/8.18.0?slim=true) | ### GitHub Vulnerability Alerts #### [CVE-2025-69873](https://nvd.nist.gov/vuln/detail/CVE-2025-69873) ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the `$data` option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax (`$data` reference), which is passed directly to the JavaScript `RegExp()` constructor without validation. An attacker can inject a malicious regex pattern (e.g., `\"^(a|a)*$\"`) combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with `$data`: true for dynamic schema validation. --- ### Release Notes <details> <summary>ajv-validator/ajv (ajv)</summary> ### [`v8.18.0`](https://redirect.github.com/ajv-validator/ajv/releases/tag/v8.18.0) [Compare Source](https://redirect.github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0) #### What's Changed - feat: allow tree-shaking by adding `"sideEffects": false` to `package.json` by [@&#8203;josdejong](https://redirect.github.com/josdejong) in [#&#8203;2480](https://redirect.github.com/ajv-validator/ajv/pull/2480) - fix: [#&#8203;2482](https://redirect.github.com/ajv-validator/ajv/issues/2482) Infinity and NaN serialise to null by [@&#8203;jasoniangreen](https://redirect.github.com/jasoniangreen) in [#&#8203;2487](https://redirect.github.com/ajv-validator/ajv/pull/2487) - fix: small grammatical error in managing-schemas.md by [@&#8203;monteiro-renato](https://redirect.github.com/monteiro-renato) in [#&#8203;2508](https://redirect.github.com/ajv-validator/ajv/pull/2508) - fix: typos in schema-language.md by [@&#8203;monteiro-renato](https://redirect.github.com/monteiro-renato) in [#&#8203;2507](https://redirect.github.com/ajv-validator/ajv/pull/2507) - fix(pattern): use configured RegExp engine with $data keyword to mitigate ReDoS attacks (CVE-2025-69873) by [@&#8203;epoberezkin](https://redirect.github.com/epoberezkin) in [#&#8203;2586](https://redirect.github.com/ajv-validator/ajv/pull/2586) #### New Contributors - [@&#8203;josdejong](https://redirect.github.com/josdejong) made their first contribution in [#&#8203;2480](https://redirect.github.com/ajv-validator/ajv/pull/2480) - [@&#8203;monteiro-renato](https://redirect.github.com/monteiro-renato) made their first contribution in [#&#8203;2508](https://redirect.github.com/ajv-validator/ajv/pull/2508) **Full Changelog**: <ajv-validator/ajv@v8.17.1...v8.18.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - "" (UTC), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/open-feature/playground). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0My4yNi41IiwidXBkYXRlZEluVmVyIjoiNDMuMjYuNSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
1 parent f576aea commit 46063ee

1 file changed

Lines changed: 48 additions & 57 deletions

File tree

0 commit comments

Comments
 (0)