Unleash / unleash / 22184411964

86%

master: 91%

push

github

chore(deps): update dependency ajv to v8.18.0 [security] (#11365)

This PR contains the following updates:

| Package | Change |
[Age](https://docs.renovatebot.com/merge-confidence/) |
[Confidence](https://docs.renovatebot.com/merge-confidence/) |
|---|---|---|---|
| [ajv](https://ajv.js.org)
([source](https://redirect.github.com/ajv-validator/ajv)) | [`8.17.1` →
`8.18.0`](https://renovatebot.com/diffs/npm/ajv/8.17.1/8.18.0) |
![age](https://developer.mend.io/api/mc/badges/age/npm/ajv/8.18.0?slim=true)
|
![confidence](https://developer.mend.io/api/mc/badges/confidence/npm/ajv/8.17.1/8.18.0?slim=true)
|

### GitHub Vulnerability Alerts

#### [CVE-2025-69873](https://nvd.nist.gov/vuln/detail/CVE-2025-69873)

ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable
to Regular Expression Denial of Service (ReDoS) when the `$data` option
is enabled. The pattern keyword accepts runtime data via JSON Pointer
syntax (`$data` reference), which is passed directly to the JavaScript
`RegExp()` constructor without validation. An attacker can inject a
malicious regex pattern (e.g., `\"^(a|a)*$\"`) combined with crafted
input to cause catastrophic backtracking. A 31-character payload causes
approximately 44 seconds of CPU blocking, with each additional character
doubling execution time. This enables complete denial of service with a
single HTTP request against any API using ajv with `$data`: true for
dynamic schema validation.

---

### Release Notes

<details>
<summary>ajv-validator/ajv (ajv)</summary>

###
[`v8.18.0`](https://redirect.github.com/ajv-validator/ajv/releases/tag/v8.18.0)

[Compare
Source](https://redirect.github.com/ajv-validator/ajv/compare/v8.17.1...v8.18.0)

#### What's Changed

- feat: allow tree-shaking by adding `"sideEffects": false` to
`package.json` by
[@&#8203;josdejong](https://redirect.github.com/josdejong) in
[#&#8203;2480](https://redirect.github.com/ajv-validator/ajv/pull/2480)
- fix:
[#&#8203;2482](https://redirect.git... (continued)

1745 of 1964 branches covered (88.85%)

14563 of 16915 relevant lines covered (86.1%)

894.79 hits per line