[security](deps-dev): Bump ajv from 8.18.0 to 8.20.0#189
[security](deps-dev): Bump ajv from 8.18.0 to 8.20.0#189dependabot[bot] wants to merge 1 commit into
Conversation
Bumps [ajv](https://github.com/ajv-validator/ajv) from 8.18.0 to 8.20.0. - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v8.18.0...v8.20.0) --- updated-dependencies: - dependency-name: ajv dependency-version: 8.20.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
LabelsThe following labels could not be found: Please fix the above issues or remove invalid values from |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 78630b5fd5
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| "@vitest/coverage-v8": "4.1.0", | ||
| "agent-browser": "0.23.0", | ||
| "ajv": "^8.18.0", | ||
| "ajv": "^8.20.0", |
There was a problem hiding this comment.
The repo-level AGENTS.md says any commit that changes behavior, config, or tooling must update root FORJAMIE.md in the same change-set and add a Recent Changes entry. This dependency/lockfile update changes the workspace tooling configuration, but the commit only modifies package.json and pnpm-lock.yaml, so the project map will be out of date until FORJAMIE.md is updated with the security bump and its impact.
Useful? React with 👍 / 👎.
| specifier: ^8.20.0 | ||
| version: 8.20.0 |
There was a problem hiding this comment.
This only updates the root importer to 8.20.0; the generated lockfile still installs ajv: 8.18.0 through two @modelcontextprotocol/sdk@1.26.0 snapshots (pnpm-lock.yaml:8828 and pnpm-lock.yaml:8852), because the workspace override still only forces vulnerable ranges to >=8.18.0. If this security change is intended to remove 8.18.0 from the installed graph, scanners and consumers will still see the old version until the override/dependent package is bumped and the lockfile is regenerated.
Useful? React with 👍 / 👎.
Bumps ajv from 8.18.0 to 8.20.0.
Release notes
Sourced from ajv's releases.
Commits
0fba0b88.20.09caf8d6fix: add ES2022.RegExp for RegExpIndicesArray; fixes ajv-validator/ajv#2603 (...2065350fix: add support for node 22/24, drop node 16/21 (#2580)154b58d8.19.0e8d2bdctest/fix prototype pollution via $data ref with format keyword (#2607)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)