Skip to content

Bump ajv in @rushstack/node-core-library to unblock vulnerable fast-uri transitive resolution#5871

Merged
iclanton merged 3 commits into
mainfrom
copilot/update-ajv-dependency-node-core-library
Jul 15, 2026
Merged

Bump ajv in @rushstack/node-core-library to unblock vulnerable fast-uri transitive resolution#5871
iclanton merged 3 commits into
mainfrom
copilot/update-ajv-dependency-node-core-library

Conversation

Copilot AI commented Jul 15, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Consumers pulling @rushstack/node-core-library through SPFx dependency chains can land on ajv@8.18.0 -> fast-uri@3.1.2, which scanners report as vulnerable. This change updates the ajv range to a newer compatible version so downstream installs resolve to patched fast-uri versions.

  • @rushstack/node-core-library dependency bump

    • Updated libraries/node-core-library/package.json:
      • ajv: ~8.18.0 → ~8.20.0

  • Rush consistency update

    • Updated libraries/rig-package/package.json to keep repo-wide ajv version alignment required by Rush:
      • devDependencies.ajv: ~8.18.0 → ~8.20.0

  • Lockfile/state + release metadata

    • Updated default subspace dependency state:
      • common/config/subspaces/default/pnpm-lock.yaml
      • common/config/subspaces/default/repo-state.json
    • Added change files for impacted packages:
      • common/changes/@rushstack/node-core-library/...
      • common/changes/@rushstack/rig-package/...

  • Example dependency-path delta

Before:
@rushstack/node-core-library -> ajv@8.18.0 -> fast-uri@3.1.2

After:
@rushstack/node-core-library -> ajv@8.20.0 -> fast-uri@3.1.3

@github-project-automation github-project-automation Bot moved this to Needs triage in Bug Triage Jul 15, 2026
Copilot AI linked an issue Jul 15, 2026 that may be closed by this pull request
Update ajv dependency in @rushstack/node-core-library to resolve vulnerable fast-uri transitive dependency #5860
Closed
Copilot AI changed the title [WIP] Update ajv dependency in @rushstack/node-core-library Bump ajv in @rushstack/node-core-library to unblock vulnerable fast-uri transitive resolution Jul 15, 2026
Copilot AI requested a review from iclanton July 15, 2026 20:13
@iclanton iclanton marked this pull request as ready for review July 15, 2026 20:47
@iclanton iclanton enabled auto-merge (squash) July 15, 2026 20:49
mojaza
mojaza approved these changes Jul 15, 2026
View reviewed changes

@mojaza mojaza left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@iclanton iclanton merged commit 439f2b3 into main Jul 15, 2026
9 checks passed
@iclanton iclanton deleted the copilot/update-ajv-dependency-node-core-library branch July 15, 2026 21:23
@github-project-automation github-project-automation Bot moved this from Needs triage to Closed in Bug Triage Jul 15, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@bmiddha bmiddha bmiddha approved these changes
@iclanton iclanton Awaiting requested review from iclanton iclanton is a code owner
@octogonz octogonz Awaiting requested review from octogonz octogonz is a code owner
@apostolisms apostolisms Awaiting requested review from apostolisms apostolisms is a code owner
@dmichon-msft dmichon-msft Awaiting requested review from dmichon-msft dmichon-msft is a code owner
@jxanthony jxanthony Awaiting requested review from jxanthony jxanthony is a code owner
+1 more reviewer
@mojaza mojaza mojaza approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@iclanton iclanton

Copilot code review Copilot

Labels

None yet

Projects

Bug Triage
Status: Closed

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Update ajv dependency in @rushstack/node-core-library to resolve vulnerable fast-uri transitive dependency

4 participants

@bmiddha @mojaza @iclanton