Skip to content

Conversation

@jahorton
Copy link
Contributor

@jahorton jahorton commented May 13, 2025

The fast-json-parser package is needed by ajv-cli, which is used during common/web/types/build.sh configure.

Found this approach via a comment on ajv-validator/ajv-cli#237.

Remaining npm audit issues after this fix:

@sentry/browser  <7.119.1
Severity: moderate
Sentry SDK Prototype Pollution gadget in JavaScript SDKs - https://github.com/advisories/GHSA-593m-55hh-j8gv
fix available via `npm audit fix --force`
Will install @sentry/[email protected], which is a breaking change
node_modules/@sentry/browser

1 moderate severity vulnerability

... and updating Sentry (for web/) is potentially something far more involved.

Test-bot: skip

The `fast-json-parser` package is needed by `ajv-cli`, which is used during common/web/types/build.sh configure.

Test-bot: skip
@keymanapp-test-bot
Copy link

User Test Results

Test specification and instructions

User tests are not required

@keymanapp-test-bot keymanapp-test-bot bot added this to the A19S3 milestone May 13, 2025
@github-actions github-actions bot added the maint Maintenance work -- continuous integration, build scripts, infrastructure label May 13, 2025
@jahorton jahorton requested review from mcdurdin and srl295 May 13, 2025 08:42
@mcdurdin mcdurdin changed the title maint: update fast-json-parser maint(common): update fast-json-parser May 15, 2025
@mcdurdin mcdurdin changed the title maint(common): update fast-json-parser maint(common): update fast-json-parser to ^3.1.1 May 15, 2025
@mcdurdin mcdurdin changed the title maint(common): update fast-json-parser to ^3.1.1 maint(common): update fast-json-patch to ^3.1.1 May 15, 2025
@mcdurdin
Copy link
Member

Can you also submit a PR upstream to ajv? ajv looks somewhat unmaintained; the suggested patch on ajv-cli is a good stop-gap but ideal is to have the upstream up-to-date.

@jahorton
Copy link
Contributor Author

Can you also submit a PR upstream to ajv? ajv looks somewhat unmaintained; the suggested patch on ajv-cli is a good stop-gap but ideal is to have the upstream up-to-date.

See ajv-validator/ajv-cli#227 - it's been waiting for approval for a while. Seems to be dead, but someone's forked the project and is maintaining it more actively. Found it via the last comment to that PR: https://github.com/jirutka/ajv-cli

@jahorton jahorton marked this pull request as ready for review May 16, 2025 07:38
@mcdurdin
Copy link
Member

someone's forked the project

Shame, picking up a maintainer is better than a fork... Hesitant to switch to the fork.

Base automatically changed from maint/update-actions-and-octokit to master May 19, 2025 01:43
@jahorton jahorton merged commit 543da5b into master May 19, 2025
5 checks passed
@jahorton jahorton deleted the maint/update-fast-json-parser branch May 19, 2025 01:43
@github-project-automation github-project-automation bot moved this to Done in Keyman May 19, 2025
@keyman-server
Copy link
Collaborator

Changes in this pull request will be available for download in Keyman version 19.0.41-alpha

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

common/ maint Maintenance work -- continuous integration, build scripts, infrastructure

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

5 participants