Skip to content

[Snyk] Security upgrade ajv from 6.12.6 to 8.18.0#1

Open
snyk-io[bot] wants to merge 1 commit intomasterfrom
snyk-fix-65c74a834f4fee3aa0216f923ce0d10e
Open

[Snyk] Security upgrade ajv from 6.12.6 to 8.18.0#1
snyk-io[bot] wants to merge 1 commit intomasterfrom
snyk-fix-65c74a834f4fee3aa0216f923ce0d10e

Conversation

@snyk-io
Copy link

@snyk-io snyk-io bot commented Feb 16, 2026

snyk-top-banner

Snyk has created this PR to fix 1 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • package.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-AJV-15274295
  685  

Breaking Change Risk

Merge Risk: High

Notice: This assessment is enhanced by AI.


Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Regular Expression Denial of Service (ReDoS)

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-JS-AJV-15274295
@snyk-io
Copy link
Author

snyk-io bot commented Feb 16, 2026

Merge Risk: High

This is a major upgrade from version 6 to 8, which includes a complete rewrite of the library in TypeScript and introduces numerous breaking changes. Developer action is required for this migration.

Key Breaking Changes:

  • Instantiation: Ajv is now an ES6 class and must be instantiated using the new keyword (e.g., const ajv = new Ajv()).
  • Formats Package: Format validation (e.g., "format": "email") is no longer included by default. You must install the ajv-formats package and add it to your Ajv instance.
  • JSON Schema Draft-04 Dropped: Support for JSON Schema draft-04 has been removed. Schemas using the "id" property must be updated to use "$id" for compatibility with newer drafts.
  • Strict Mode: Strict mode is now enabled by default, which can cause validation to fail on schemas with potential mistakes or ambiguities that were previously ignored.
  • Error Reporting: The dataPath property in error objects has been renamed to instancePath. Error messages have also been changed.
  • API Changes: The addKeyword API has been modified. The keyword name is now passed as a property within the definition object instead of as the first argument.

Recommendation:
Due to the significant number of breaking changes, a careful migration is necessary. Developers should review the official migration guide, update instantiation logic, add the ajv-formats package if needed, and test all schemas and error handling logic thoroughly.

Source: Changes from Ajv v6 to v8

Notice 🤖: This content was augmented using artificial intelligence. AI-generated content may contain errors and should be reviewed for accuracy before use.

@snyk-io
Copy link
Author

snyk-io bot commented Feb 16, 2026

Snyk checks have passed. No issues have been found so far.

Status Scanner Critical High Medium Low Total (0)
Open Source Security 0 0 0 0 0 issues
Licenses 0 0 0 0 0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants

Comments