Skip to content

fix: update ajv from 6.12.6 to 8.18.0 - high severity vulnerability fix#201

Merged
justinchung-cb merged 1 commit intomasterfrom
justinchung/otk-48-update-ajv-from-6126-to-8180-high-severity-vulnerability-fix
Feb 26, 2026
Merged

fix: update ajv from 6.12.6 to 8.18.0 - high severity vulnerability fix#201
justinchung-cb merged 1 commit intomasterfrom
justinchung/otk-48-update-ajv-from-6126-to-8180-high-severity-vulnerability-fix

Conversation

@justinchung-cb
Copy link
Contributor

@justinchung-cb justinchung-cb commented Feb 26, 2026

Description

Resolves a HIGH severity vulnerability flagged by Vulnerability Management for pkg:npm/ajv@6.12.6 in c3/onchain-test-kit.

  • Fix By Date: 2026-03-04
  • Recommended Version: 8.18.0
  • ajv@6.12.6 was a transitive dependency pulled in by eslint@8 via @eslint/eslintrc in the example/frontend workspace
  • Adds "ajv": "^8.18.0" to the root resolutions field in package.json to force the secure version across all workspaces

Fixes OTK-48

Type of Change

  • Chore (e.g., refactoring, build improvements, tooling, dependency updates)

Checklist

  • I have read the CONTRIBUTING.md document.
  • My code follows the style guidelines of this project (e.g., yarn lint, yarn format).
  • I have performed a self-review of my code.
  • I have updated documentation to reflect my changes (if applicable).
  • I have added tests for my changes (if applicable, and new/existing tests pass).
  • All commits in this PR are signed.

@linear
Copy link

linear bot commented Feb 26, 2026

@cb-heimdall
Copy link

cb-heimdall commented Feb 26, 2026

✅ Heimdall Review Status

Requirement Status More Info
Reviews 1/1
Denominator calculation
Show calculation
1 if user is bot 0
1 if user is external 0
2 if repo is sensitive 0
From .codeflow.yml 1
Additional review requirements
Show calculation
Max 0
0
From CODEOWNERS 0
Global minimum 0
Max 1
1
1 if commit is unverified 0
Sum 1

…ability

Add ajv resolution override in root package.json to force version ^8.18.0,
replacing the vulnerable transitive dependency (6.12.6) pulled in by eslint
via @eslint/eslintrc in the example/frontend workspace.

Resolves: OTK-48
Made-with: Cursor
@justinchung-cb justinchung-cb force-pushed the justinchung/otk-48-update-ajv-from-6126-to-8180-high-severity-vulnerability-fix branch from 65a7def to 4626f40 Compare February 26, 2026 20:47
@justinchung-cb justinchung-cb merged commit 11459de into master Feb 26, 2026
7 checks passed
@justinchung-cb justinchung-cb deleted the justinchung/otk-48-update-ajv-from-6126-to-8180-high-severity-vulnerability-fix branch February 26, 2026 20:53
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

3 participants