Uh oh!
There was an error while loading. Please reload this page.
chore(deps): bump ajv from 8.17.1 to 8.18.0 - #5709
Conversation
rtibbles
commented
Mar 1, 2026
@dependabot rebase |
90c3622 to
48c1d37Compare
rtibblesbot
left a comment
There was a problem hiding this comment.
Dependency Update Review
Package:ajv 8.17.1 → 8.18.0
Semver risk: Minor
Dependency type: Production
CI status: Contributor check fails (expected for bot PRs); substantive checks (frontend tests, linting, build) still in progress
Changelog Analysis
Sources consulted:
Breaking changes: None.
Security fixes:
- CVE-2025-69873: ReDoS mitigation — pattern validation now uses the configured RegExp engine with
$datakeyword (ajv-validator/ajv#2586)
Other notable changes:
- Tree-shaking support via
"sideEffects": falsein package.json - Fix:
InfinityandNaNvalues no longer serialize incorrectly tonull(#2482)
Compatibility Assessment
- Breaking changes: none
- Peer dependency changes: none
- Code changes required: none
- Lockfile changes:
ajv8.17.1 → 8.18.0 and transitive depfast-uri3.0.6 → 3.1.0 — expected - Target branch:
unstable(default branch) — correct
Recommendation
APPROVE once CI completes — minor bump with no breaking changes and a security fix (CVE-2025-69873). The Infinity/NaN serialization fix is a correctness improvement. Recommend merging promptly given the CVE.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Reviewed the pull request diff checking for:
- Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
- Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
- Architecture: duplicated concerns, minimal interfaces, composition over inheritance
- Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
- Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
- Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
- Checked CI status and linked issue acceptance criteria
- For UI changes: inspected screenshots for layout, visual completeness, and consistency
rtibblesbot
left a comment
There was a problem hiding this comment.
Minor dependency bump (ajv 8.17.1 → 8.18.0) with a security fix (CVE-2025-69873 ReDoS mitigation), no breaking changes.
CI: frontend tests, linting, and build still in progress; path checks and message build passing. Target branch unstable is correct (repo default).
Lockfile changes are expected: ajv 8.17.1 → 8.18.0, transitive fast-uri 3.0.6 → 3.1.0, ajv 6.12.6 → 6.14.0.
1 prior finding(s) resolved.
@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly
How was this generated?
Compared the current PR state against findings from a prior review:
- Retrieved prior bot reviews deterministically via the GitHub API
- Classified each prior finding as RESOLVED, UNADDRESSED, ACKNOWLEDGED, or CONTESTED
- Only raised NEW findings for newly introduced code
- Reviewed the pull request diff checking for correctness, design, architecture, testing, completeness, and adherence to DRY/SRP principles
- Checked CI status and linked issue acceptance criteria
48c1d37 to
fa11e34Comparefa11e34 to
dd4f187Comparertibbles
commented
Apr 16, 2026
@dependabot rebase |
dd4f187 to
3a84374Comparertibbles
commented
Apr 16, 2026
@dependabot rebase |
Bumps [ajv](https://github.com/ajv-validator/ajv) from 8.17.1 to 8.18.0. - [Release notes](https://github.com/ajv-validator/ajv/releases) - [Commits](ajv-validator/ajv@v8.17.1...v8.18.0) --- updated-dependencies: - dependency-name: ajv dependency-version: 8.18.0 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
3a84374 to
637aaacCompare
Bumps ajv from 8.17.1 to 8.18.0.
Release notes
Sourced from ajv's releases.
Commits
142ce848.18.0720a23ffix(pattern): use configured RegExp engine with $data keyword to mitigate ReD...82735a1fix: typos in schema-language.md (#2507)b17ec32fix: small grammatical error in managing-schemas.md (#2508)69568d0fix: #2482 Infinity and NaN serialise to null (#2487)f06766ffeat: allow tree-shaking by adding ``"sideEffects": falsetopackage.json` ...