diff --git a/common/changes/@rushstack/node-core-library/iclanton-ajv-fast-uri_2026-07-15-20-12.json b/common/changes/@rushstack/node-core-library/iclanton-ajv-fast-uri_2026-07-15-20-12.json new file mode 100644 index 0000000000..c2b7081f01 --- /dev/null +++ b/common/changes/@rushstack/node-core-library/iclanton-ajv-fast-uri_2026-07-15-20-12.json @@ -0,0 +1,11 @@ +{ + "changes": [ + { + "packageName": "@rushstack/node-core-library", + "comment": "Update `ajv` dependency to `~8.20.0` to resolve vulnerable transitive `fast-uri` versions.", + "type": "patch" + } + ], + "packageName": "@rushstack/node-core-library", + "email": "rushbot@users.noreply.github.com" +} diff --git a/common/changes/@rushstack/rig-package/iclanton-ajv-fast-uri-consistency_2026-07-15-20-12.json b/common/changes/@rushstack/rig-package/iclanton-ajv-fast-uri-consistency_2026-07-15-20-12.json new file mode 100644 index 0000000000..f2c7f81beb --- /dev/null +++ b/common/changes/@rushstack/rig-package/iclanton-ajv-fast-uri-consistency_2026-07-15-20-12.json @@ -0,0 +1,11 @@ +{ + "changes": [ + { + "packageName": "@rushstack/rig-package", + "comment": "Update `ajv` devDependency to `~8.20.0` for dependency consistency.", + "type": "none" + } + ], + "packageName": "@rushstack/rig-package", + "email": "rushbot@users.noreply.github.com" +} diff --git a/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml b/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml index 991e459c6a..f2fe7f12cb 100644 --- a/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml +++ b/common/config/subspaces/build-tests-subspace/pnpm-lock.yaml @@ -1386,6 +1386,9 @@ packages: ajv@8.18.0: resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==} + ajv@8.20.0: + resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==} + ansi-escapes@4.3.2: resolution: {integrity: sha512-gKXj5ALrKWQLsYG9jlTRmR/xKluxHV+Z9QEwNIgCfM1/uwPMCuzVVnh5mwTd+OuBZcwSIMbqssNWRm1lE51QaQ==} engines: {node: '>=8'} @@ -4858,8 +4861,8 @@ snapshots: '@rushstack/node-core-library@file:../../../libraries/node-core-library(@types/node@20.17.19)': dependencies: - ajv: 8.18.0 - ajv-draft-04: 1.0.0(ajv@8.18.0) + ajv: 8.20.0 + ajv-draft-04: 1.0.0(ajv@8.20.0) ajv-formats: 3.0.1 fs-extra: 11.3.4 import-lazy: 4.0.0 @@ -5434,9 +5437,9 @@ snapshots: transitivePeerDependencies: - supports-color - ajv-draft-04@1.0.0(ajv@8.18.0): + ajv-draft-04@1.0.0(ajv@8.20.0): optionalDependencies: - ajv: 8.18.0 + ajv: 8.20.0 ajv-formats@2.1.1: dependencies: @@ -5444,7 +5447,7 @@ snapshots: ajv-formats@3.0.1: dependencies: - ajv: 8.18.0 + ajv: 8.20.0 ajv-keywords@5.1.0(ajv@8.18.0): dependencies: @@ -5465,6 +5468,13 @@ snapshots: json-schema-traverse: 1.0.0 require-from-string: 2.0.2 + ajv@8.20.0: + dependencies: + fast-deep-equal: 3.1.3 + fast-uri: 3.1.0 + json-schema-traverse: 1.0.0 + require-from-string: 2.0.2 + ansi-escapes@4.3.2: dependencies: type-fest: 0.21.3 diff --git a/common/config/subspaces/build-tests-subspace/repo-state.json b/common/config/subspaces/build-tests-subspace/repo-state.json index 2476c57268..11601e113f 100644 --- a/common/config/subspaces/build-tests-subspace/repo-state.json +++ b/common/config/subspaces/build-tests-subspace/repo-state.json @@ -1,6 +1,6 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "87c647fd506f99cd51fed76e2cf70701fd16db9d", + "pnpmShrinkwrapHash": "010f7dd33d0f279806ebcc482ad3056eb190f8d1", "preferredVersionsHash": "550b4cee0bef4e97db6c6aad726df5149d20e7d9", - "packageJsonInjectedDependenciesHash": "d32e6cb68db22aa7c0159d470b68a1429e79e112" + "packageJsonInjectedDependenciesHash": "5e271b1cb564280bc3d9ab1d9cb3490f0286ac78" } diff --git a/common/config/subspaces/default/pnpm-lock.yaml b/common/config/subspaces/default/pnpm-lock.yaml index b3e4f8db35..428306e520 100644 --- a/common/config/subspaces/default/pnpm-lock.yaml +++ b/common/config/subspaces/default/pnpm-lock.yaml @@ -3828,14 +3828,14 @@ importers: ../../../libraries/node-core-library: dependencies: ajv: - specifier: ~8.18.0 - version: 8.18.0 + specifier: ~8.20.0 + version: 8.20.0 ajv-draft-04: specifier: ~1.0.0 - version: 1.0.0(ajv@8.18.0) + version: 1.0.0(ajv@8.20.0) ajv-formats: specifier: ~3.0.1 - version: 3.0.1(ajv@8.18.0) + version: 3.0.1(ajv@8.20.0) fs-extra: specifier: ~11.3.0 version: 11.3.4 @@ -4023,8 +4023,8 @@ importers: specifier: 1.20.2 version: 1.20.2 ajv: - specifier: ~8.18.0 - version: 8.18.0 + specifier: ~8.20.0 + version: 8.20.0 decoupled-local-node-rig: specifier: workspace:* version: link:../../rigs/decoupled-local-node-rig @@ -11018,6 +11018,9 @@ packages: ajv@8.18.0: resolution: {integrity: sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A==} + ajv@8.20.0: + resolution: {integrity: sha512-Thbli+OlOj+iMPYFBVBfJ3OmCAnaSyNn4M1vz9T6Gka5Jt9ba/HIR56joy65tY6kx/FCF5VXNB819Y7/GUrBGA==} + ansi-align@3.0.1: resolution: {integrity: sha512-IOfwwBF5iczOjp/WeY4YxyjqAFMQoZufdQWDd19SEExbVLNXqvpzSJ/M7Za4/sCPmQ0+GRquoA7bGcINcxew6w==} @@ -27941,25 +27944,33 @@ snapshots: optionalDependencies: ajv: 8.18.0 + ajv-draft-04@1.0.0(ajv@8.20.0): + optionalDependencies: + ajv: 8.20.0 + ajv-errors@1.0.1(ajv@6.14.0): dependencies: ajv: 6.14.0 ajv-formats@2.1.1: dependencies: - ajv: 8.18.0 + ajv: 8.20.0 ajv-formats@3.0.1(ajv@8.18.0): optionalDependencies: ajv: 8.18.0 + ajv-formats@3.0.1(ajv@8.20.0): + optionalDependencies: + ajv: 8.20.0 + ajv-keywords@3.5.2(ajv@6.14.0): dependencies: ajv: 6.14.0 - ajv-keywords@5.1.0(ajv@8.18.0): + ajv-keywords@5.1.0(ajv@8.20.0): dependencies: - ajv: 8.18.0 + ajv: 8.20.0 fast-deep-equal: 3.1.3 ajv@6.14.0: @@ -27983,6 +27994,13 @@ snapshots: json-schema-traverse: 1.0.0 require-from-string: 2.0.2 + ajv@8.20.0: + dependencies: + fast-deep-equal: 3.1.3 + fast-uri: 3.1.0 + json-schema-traverse: 1.0.0 + require-from-string: 2.0.2 + ansi-align@3.0.1: dependencies: string-width: 4.2.3 @@ -29246,7 +29264,7 @@ snapshots: conf@10.2.0: dependencies: - ajv: 8.18.0 + ajv: 8.20.0 ajv-formats: 2.1.1 atomically: 1.7.0 debounce-fn: 4.0.0 @@ -33756,7 +33774,7 @@ snapshots: light-my-request@4.12.0: dependencies: - ajv: 8.18.0 + ajv: 8.20.0 cookie: 0.5.0 process-warning: 1.0.0 set-cookie-parser: 2.7.2 @@ -36247,9 +36265,9 @@ snapshots: schema-utils@4.3.3: dependencies: '@types/json-schema': 7.0.15 - ajv: 8.18.0 + ajv: 8.20.0 ajv-formats: 2.1.1 - ajv-keywords: 5.1.0(ajv@8.18.0) + ajv-keywords: 5.1.0(ajv@8.20.0) secure-json-parse@2.7.0: {} @@ -37024,7 +37042,7 @@ snapshots: table@6.9.0: dependencies: - ajv: 8.18.0 + ajv: 8.20.0 lodash.truncate: 4.4.2 slice-ansi: 4.0.0 string-width: 4.2.3 diff --git a/common/config/subspaces/default/repo-state.json b/common/config/subspaces/default/repo-state.json index 8df344ceac..e3ea34eca4 100644 --- a/common/config/subspaces/default/repo-state.json +++ b/common/config/subspaces/default/repo-state.json @@ -1,5 +1,5 @@ // DO NOT MODIFY THIS FILE MANUALLY BUT DO COMMIT IT. It is generated and used by Rush. { - "pnpmShrinkwrapHash": "0327c1a683777b35c43a560eb7ccd641ef9d32ec", + "pnpmShrinkwrapHash": "732d8477a16e23b71c3b101712e2621d669b736b", "preferredVersionsHash": "029c99bd6e65c5e1f25e2848340509811ff9753c" } diff --git a/libraries/node-core-library/package.json b/libraries/node-core-library/package.json index a23782c1db..2f53154387 100644 --- a/libraries/node-core-library/package.json +++ b/libraries/node-core-library/package.json @@ -44,7 +44,7 @@ "jju": "~1.4.0", "resolve": "~1.22.1", "semver": "~7.7.4", - "ajv": "~8.18.0", + "ajv": "~8.20.0", "ajv-draft-04": "~1.0.0", "ajv-formats": "~3.0.1" }, diff --git a/libraries/rig-package/package.json b/libraries/rig-package/package.json index 381a16e2b5..ad8be86fc4 100644 --- a/libraries/rig-package/package.json +++ b/libraries/rig-package/package.json @@ -47,7 +47,7 @@ "@rushstack/heft": "1.2.19", "@types/jju": "1.4.1", "@types/resolve": "1.20.2", - "ajv": "~8.18.0", + "ajv": "~8.20.0", "decoupled-local-node-rig": "workspace:*", "eslint": "~9.37.0", "resolve": "~1.22.1"