Adarshvk98 opened a new pull request, #3702: URL: https://github.com/apache/incubator-kie-tools/pull/3702
CVE-2026-15195: prototype pollution in @apidevtools/json-schema-ref-parser Two copies were affected. `runtime-tools-components` depends on 13.0.5 directly, and `@apidevtools/[email protected]` requires exactly version 9.0.6. The override applies to every version because no swagger-parser release includes a fixed parser, so version 10.1.0 could not reach one on its own. Both copies now resolve to 15.5.1, which means swagger-parser uses 15.5.1 instead of 9.0.6. Please review that part. The `@apidevtools/json-schema-ref-parser>js-yaml` override is removed. Version 9.0.6 needed js-yaml 3.x. Version 15.5.1 uses js-yaml 5.2.3, which has no open advisories. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
