This is an automated email from the ASF dual-hosted git repository.
Kusuma04-dev pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/incubator-kie-tools.git
The following commit(s) were added to refs/heads/main by this push:
new 7270d77d288 NO-ISSUE: CVE-2026-15195: upgrade json-schema-ref-parser
to 15.3.6 (#3702)
7270d77d288 is described below
commit 7270d77d288e5c74c47be4a8e1e7c881811df0d3
Author: Adarsh vk <[email protected]>
AuthorDate: Tue Aug 11 23:34:47 2026 +0530
NO-ISSUE: CVE-2026-15195: upgrade json-schema-ref-parser to 15.3.6 (#3702)
---
packages/runtime-tools-components/package.json | 2 +-
pnpm-lock.yaml | 49 ++++++++++++++------------
pnpm-workspace.yaml | 3 +-
3 files changed, 29 insertions(+), 25 deletions(-)
diff --git a/packages/runtime-tools-components/package.json
b/packages/runtime-tools-components/package.json
index ef88ab18a50..ab1e397ecbe 100644
--- a/packages/runtime-tools-components/package.json
+++ b/packages/runtime-tools-components/package.json
@@ -24,7 +24,7 @@
"lint": "run-script-if --bool \"$(build-env linters.run)\" --then
\"kie-tools--eslint ./src\""
},
"dependencies": {
- "@apidevtools/json-schema-ref-parser": "^13.0.5",
+ "@apidevtools/json-schema-ref-parser": "^15.3.6",
"@kie-tools-core/editor": "workspace:*",
"@kie-tools-core/operating-system": "workspace:*",
"@kie-tools-core/patternfly-base": "workspace:*",
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index 4bc1170c094..582be56d5ec 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -5,7 +5,7 @@ settings:
excludeLinksFromLockfile: false
overrides:
- '@apidevtools/json-schema-ref-parser>js-yaml': ^3.15.0
+ '@apidevtools/swagger-parser>@apidevtools/json-schema-ref-parser': ^15.3.6
'@istanbuljs/load-nyc-config>js-yaml': ^3.15.0
cross-spawn: ^7.0.6
d3-color: 3.1.0
@@ -6397,8 +6397,8 @@ importers:
packages/runtime-tools-components:
dependencies:
'@apidevtools/json-schema-ref-parser':
- specifier: ^13.0.5
- version: 13.0.5
+ specifier: ^15.3.6
+ version: 15.5.1(@types/[email protected])
'@kie-tools-core/editor':
specifier: workspace:*
version: link:../editor
@@ -6785,7 +6785,7 @@ importers:
dependencies:
'@apidevtools/swagger-parser':
specifier: ^10.1.0
- version: 10.1.1([email protected])
+ version: 10.1.1(@types/[email protected])([email protected])
'@babel/standalone':
specifier: 7.15.3
version: 7.15.3
@@ -7177,7 +7177,7 @@ importers:
dependencies:
'@apidevtools/swagger-parser':
specifier: ^10.1.0
- version: 10.1.1([email protected])
+ version: 10.1.1(@types/[email protected])([email protected])
'@kie-tools/runtime-tools-shared-gateway-api':
specifier: workspace:*
version: link:../runtime-tools-shared-gateway-api
@@ -9324,13 +9324,11 @@ packages:
'@angular/animations':
optional: true
- '@apidevtools/[email protected]':
- resolution: {integrity:
sha512-4gY54eEGEstClvEkGnwVkTkrx0sqwemEFG5OSRRn3tD91XH0+Q8XIkYIfo7IwEWPpJZwILb9GUXeShtplRc/eA==}
- engines: {node: '>= 16'}
-
- '@apidevtools/[email protected]':
- resolution: {integrity:
sha512-xfh4xVJD62gG6spIc7lwxoWT+l16nZu1ELyU8FkjaP/oD2yP09EvLAU6KhtudN9aML2Khhs9pY6Slr7KGTES3w==}
- engines: {node: '>= 16'}
+ '@apidevtools/[email protected]':
+ resolution: {integrity:
sha512-69KDKWQvk5jfDQfSTzAUHkI731X7CaJLwQxlS87AXyFHoJzsd/Pufrqsz7PqXMgrtAA99D9Y6NujkEkzli6kVA==}
+ engines: {node: '>=20'}
+ peerDependencies:
+ '@types/json-schema': ^7.0.15
'@apidevtools/[email protected]':
resolution: {integrity:
sha512-Zc1AlqrJlX3SlpupFGpiLi2EbteyP7fXmUOGup6/DnkRgjP9bgMM/ag+n91rsv0U1Gpz0H3VILA/o3bW7Ua6BQ==}
@@ -18557,6 +18555,10 @@ packages:
resolution: {integrity:
sha512-1td788aAnnZ5qs7V2QIRl1owjtYpbKt749Y3xauqQgwIIGF/xXWz1wMTEBx5O3LK3lXLVuqXPdPxj2BoFHaW9Q==}
hasBin: true
+ [email protected]:
+ resolution: {integrity:
sha512-n+mUVyUX5bVv7G/G2zyIHOhdxfuU1dY2NOFzTQUWiMUbFss8b57NFlgCCaggU78wSw5KVS9cllzeLyzyR+n5nw==}
+ hasBin: true
+
[email protected]:
resolution: {integrity:
sha512-UVU9dibq2JcFWxQPA6KCqj5O42VOmAY3zQUfEKxU0KpTGXwNoCjkX1e13eHNvw/xPynt6pU0rZ1htjWTNTSXsg==}
@@ -24216,24 +24218,19 @@ snapshots:
'@angular/core':
20.3.27(@angular/[email protected])([email protected])([email protected])
tslib: 2.8.1
- '@apidevtools/[email protected]':
- dependencies:
- '@jsdevtools/ono': 7.1.3
- '@types/json-schema': 7.0.15
- js-yaml: 3.15.0
-
- '@apidevtools/[email protected]':
+ '@apidevtools/[email protected](@types/[email protected])':
dependencies:
'@types/json-schema': 7.0.15
- js-yaml: 3.15.0
+ js-yaml: 5.2.3
+ undici: 6.28.0
'@apidevtools/[email protected]': {}
'@apidevtools/[email protected]': {}
- '@apidevtools/[email protected]([email protected])':
+
'@apidevtools/[email protected](@types/[email protected])([email protected])':
dependencies:
- '@apidevtools/json-schema-ref-parser': 11.7.2
+ '@apidevtools/json-schema-ref-parser': 15.5.1(@types/[email protected])
'@apidevtools/openapi-schemas': 2.1.0
'@apidevtools/swagger-methods': 3.0.2
'@jsdevtools/ono': 7.1.3
@@ -24241,6 +24238,8 @@ snapshots:
ajv-draft-04: 1.0.0([email protected])
call-me-maybe: 1.0.2
openapi-types: 7.2.3
+ transitivePeerDependencies:
+ - '@types/json-schema'
'@apollo/[email protected]':
dependencies:
@@ -26591,7 +26590,7 @@ snapshots:
camelcase: 5.3.1
find-up: 4.1.0
get-package-type: 0.1.0
- js-yaml: 3.15.0
+ js-yaml: 3.15.1
resolve-from: 5.0.0
'@istanbuljs/[email protected]': {}
@@ -36791,6 +36790,10 @@ snapshots:
dependencies:
argparse: 2.0.1
+ [email protected]:
+ dependencies:
+ argparse: 2.0.1
+
[email protected]: {}
[email protected](@babel/[email protected](@babel/[email protected])):
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 4b486224d7c..3a551cd8721 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -3,8 +3,9 @@ packages:
- "examples/*"
- "scripts/*"
overrides:
+ # CVE-2026-15195: Prototype pollution in Pointer.set. Fixed in 15.3.6.
+ "@apidevtools/swagger-parser>@apidevtools/json-schema-ref-parser": "^15.3.6"
# GHSA-h67p-54hq-rp68: js-yaml 3.x prototype-pollution/ReDoS — upgrade
transitive consumers to patched 3.15.0
- "@apidevtools/json-schema-ref-parser>js-yaml": "^3.15.0"
"@istanbuljs/load-nyc-config>js-yaml": "^3.15.0"
"cross-spawn": "^7.0.6"
"d3-color": "3.1.0"
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
