Skip to content

fix(deps): upgrade ajv from v6 to v8 to resolve ReDoS vulnerability - #977

Open
cryptodev-2s wants to merge 1 commit into
open-rpc:masterfrom
cryptodev-2s:fix/upgrade-ajv-v8
Open

cryptodev-2s wants to merge 1 commit into
open-rpc:masterfrom
cryptodev-2s:fix/upgrade-ajv-v8

Conversation

@cryptodev-2s

Copy link
Copy Markdown

Summary

  • Upgrade ajv from ^6.10.0 to ^8.18.0 to fix moderate severity ReDoS vulnerability GHSA-2g4f-4pwh-qvx6
  • Add ajv-formats@^3.0.1 (formats were extracted to a separate package in v8)
  • Update type imports and test mocks for v8 compatibility

Changes

File Change
package.json ajv ^6.10.0 → ^8.18.0, add ajv-formats
validate-open-rpc-document.ts Add addFormats(), set strict: false (needed for draft-07 style additionalItems in @json-schema-tools/meta-schema)
method-call-validator.ts Update Ajv as IAjv → Ajv (v8 type export), add addFormats()
parameter-validation-error.test.ts dataPath → instancePath in mock ErrorObject

Breaking change

ErrorObject.dataPath was renamed to ErrorObject.instancePath in ajv v8. Downstream code accessing error object properties directly will need to update.

Test plan

  • All 79 unit tests pass
  • TypeScript compiles clean
  • Webpack web build succeeds
  • 100% line coverage maintained

BREAKING CHANGE: `ErrorObject.dataPath` is renamed to `ErrorObject.instancePath` in ajv v8
@codecov

codecov Bot commented Feb 17, 2026 •

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 100.00%. Comparing base (de3dca3) to head (cfc719b).
⚠️ Report is 14 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff            @@
##            master      #977   +/-   ##
=========================================
  Coverage   100.00%   100.00%           
=========================================
  Files           16        16           
  Lines          528       532    +4     
  Branches       136       136           
=========================================
+ Hits           528       532    +4     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant