Skip to content

chore: fix remaining ajv dependabot alert#961

Merged
jonathannorris merged 1 commit intomainfrom
chore-fix-remaining-dependabot-alert
Mar 12, 2026
Merged

chore: fix remaining ajv dependabot alert#961
jonathannorris merged 1 commit intomainfrom
chore-fix-remaining-dependabot-alert

Conversation

@jonathannorris
Copy link
Member

Summary

Motivation

ajv-formats@2.1.1 depends on ajv@^8.0.0 which yarn resolved separately to 8.17.1 (vulnerable to ReDoS via $data option), while the ^8.9.0 range from schema-utils already resolved to the patched 8.18.0. The resolution ensures both ranges resolve to the same patched version.

Copilot AI review requested due to automatic review settings March 12, 2026 14:42
Copy link
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR addresses a remaining Dependabot alert by forcing all ajv@^8.0.0 consumers to resolve to the patched ajv@8.18.0, avoiding Yarn installing both 8.17.1 (vulnerable) and 8.18.0 in parallel.

Changes:

  • Added a Yarn resolutions override to pin ajv@^8.0.0 to 8.18.0.
  • Updated yarn.lock so the resolved AJV v8 version is consistently 8.18.0 (with no remaining 8.17.1 entries).

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated no comments.

File Description
package.json Adds ajv@^8.0.0: 8.18.0 to resolutions to prevent vulnerable AJV v8 installs.
yarn.lock Reflects the unified AJV v8 resolution at 8.18.0 and removes the previous 8.17.1 resolution entry.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

@cloudflare-workers-and-pages
Copy link

Deploying devcycle-docs with  Cloudflare Pages  Cloudflare Pages

Latest commit: 99720dd
Status: ✅  Deploy successful!
Preview URL: https://97231947.devcycle-docs.pages.dev
Branch Preview URL: https://chore-fix-remaining-dependab.devcycle-docs.pages.dev

View logs

@jonathannorris jonathannorris merged commit f084a5f into main Mar 12, 2026
9 checks passed
@jonathannorris jonathannorris deleted the chore-fix-remaining-dependabot-alert branch March 12, 2026 19:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants