Skip to content

chore(deps): bump ajv #41049

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ggazzo merged 1 commit into from
Jun 24, 2026
Merged

chore(deps): bump ajv #41049

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/meteor/ee/server/services/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@
"@rocket.chat/rest-typings": "workspace:^",
"@rocket.chat/string-helpers": "~0.32.0",
"@rocket.chat/ui-kit": "workspace:~",
"ajv": "^8.17.1",
"ajv": "^8.20.0",
"bcrypt": "^6.0.0",
"body-parser": "^1.20.4",
"colorette": "^2.0.20",
Expand Down
2 changes: 1 addition & 1 deletion apps/meteor/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,7 +166,7 @@
"@types/meteor": "^2.9.11",
"@xmldom/xmldom": "~0.8.13",
"adm-zip": "0.5.17",
"ajv": "^8.17.1",
"ajv": "^8.20.0",
"ajv-formats": "~3.0.1",
"archiver": "^7.0.1",
"asterisk-manager": "^0.2.0",
Expand Down
6 changes: 6 additions & 0 deletions package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,12 @@
"cross-spawn": "7.0.6",
"drachtio-srf": "patch:drachtio-srf@npm%3A5.0.12#~/.yarn/patches/drachtio-srf-npm-5.0.12-b0b1afaad6.patch",
"ajv/fast-uri": "3.1.2",
"ajv@npm:^6.12.4": "6.15.0",
"ajv@npm:^6.12.5": "6.15.0",
"ajv@npm:^6.14.0": "6.15.0",
"ajv@npm:^8.0.0": "8.20.0",
"ajv@npm:^8.0.1": "8.20.0",
"ajv@npm:^8.9.0": "8.20.0",
Comment on lines +61 to +66

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Ajv resolution entries in root package.json:"
python - <<'PY'
import json
from pathlib import Path
pkg = json.loads(Path("package.json").read_text())
for k,v in pkg.get("resolutions", {}).items():
    if k.startswith("ajv@npm:"):
        print(f"{k} -> {v}")
PY

echo
echo "Ajv descriptors currently present in yarn.lock:"
rg -n '^"ajv@npm:\^' yarn.lock || true

echo
echo "Workspace package manifests requesting ajv ranges:"
fd -p package.json | xargs rg -n '"ajv"\s*:\s*"\^'

Repository: RocketChat/Rocket.Chat

Length of output: 804

🏁 Script executed:

sed -n '1,140p' package.json

Repository: RocketChat/Rocket.Chat

Length of output: 5896

🏁 Script executed:

sed -n '1,140p' package.json

Repository: RocketChat/Rocket.Chat

Length of output: 5896

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "package.json relevant section:"
sed -n '1,140p' package.json

echo
echo "yarn.lock ajv-related entries:"
rg -n '(^"|ajv@npm:|ajv@)' yarn.lock | head -n 80

Repository: RocketChat/Rocket.Chat

Length of output: 10217

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "package.json relevant section:"
sed -n '1,140p' package.json

echo
echo "yarn.lock ajv-related entries:"
rg -n '(^\"|ajv@npm:|ajv@)' yarn.lock | head -n 80

Repository: RocketChat/Rocket.Chat

Length of output: 6047

Add ajv@npm:^8.20.0 to the resolutions block.

The current pins cover ^8.0.0, ^8.0.1, and ^8.9.0, but workspaces now depend on ajv: "^8.20.0". Without an exact resolution for that descriptor, the pin won’t apply to those requests.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` around lines 61 - 66, The resolutions block is missing an exact
pin for the new ajv descriptor, so requests for ajv@npm:^8.20.0 will not be
covered. Update the package.json resolutions entry near the existing ajv pins to
add ajv@npm:^8.20.0 mapped to the same 8.20.0 version, keeping it alongside the
other ajv resolution keys.

@cubic-dev-ai cubic-dev-ai Bot Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2: For consistency and to prevent future version drift, add "ajv@npm:^8.20.0": "8.20.0" to the resolutions block. The existing pins only cover ^8.0.0, ^8.0.1, and ^8.9.0 (for transitive dependencies), but the workspace packages now directly depend on ^8.20.0. Yarn resolutions must match the exact range descriptor — without a matching entry, a future yarn install could resolve ^8.20.0 to a newer version (e.g., 8.21.0) bypassing the intended pin.

Prompt for AI agents 
Check if this issue is valid — if so, understand the root cause and fix it. At package.json, line 66:

<comment>For consistency and to prevent future version drift, add `"ajv@npm:^8.20.0": "8.20.0"` to the resolutions block. The existing pins only cover `^8.0.0`, `^8.0.1`, and `^8.9.0` (for transitive dependencies), but the workspace packages now directly depend on `^8.20.0`. Yarn resolutions must match the exact range descriptor — without a matching entry, a future `yarn install` could resolve `^8.20.0` to a newer version (e.g., 8.21.0) bypassing the intended pin.</comment>

<file context>
@@ -58,6 +58,12 @@
+		"ajv@npm:^6.14.0": "6.15.0",
+		"ajv@npm:^8.0.0": "8.20.0",
+		"ajv@npm:^8.0.1": "8.20.0",
+		"ajv@npm:^8.9.0": "8.20.0",
 		"fast-xml-parser@npm:5.3.6": "^5.5.7",
 		"fast-xml-parser/fast-xml-builder": "^1.1.9",
</file context>
Suggested change
"ajv@npm:^8.9.0": "8.20.0",
"ajv@npm:^8.9.0": "8.20.0",
"ajv@npm:^8.20.0": "8.20.0",

"fast-xml-parser@npm:5.3.6": "^5.5.7",
"fast-xml-parser/fast-xml-builder": "^1.1.9",
"is-svg/fast-xml-parser": "5.5.11",
Expand Down
2 changes: 1 addition & 1 deletion packages/http-router/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
"@rocket.chat/core-typings": "workspace:^",
"@rocket.chat/logger": "workspace:^",
"@rocket.chat/rest-typings": "workspace:^",
"ajv": "^8.17.1",
"ajv": "^8.20.0",
"express": "^4.21.2",
"hono": "4.12.25",
"qs": "^6.15.2"
Expand Down
2 changes: 1 addition & 1 deletion packages/livechat/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,7 +33,7 @@
"@rocket.chat/message-parser": "workspace:^",
"@rocket.chat/random": "workspace:~",
"@rocket.chat/ui-kit": "workspace:~",
"ajv": "^8.17.1",
"ajv": "^8.20.0",
"ajv-formats": "^3.0.1",
"css-vars-ponyfill": "^2.4.9",
"date-fns": "~4.1.0",
Expand Down
2 changes: 1 addition & 1 deletion packages/media-signaling/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@
},
"dependencies": {
"@rocket.chat/emitter": "^0.32.0",
"ajv": "^8.17.1"
"ajv": "^8.20.0"
},
"devDependencies": {
"@rocket.chat/jest-presets": "workspace:~",
Expand Down
2 changes: 1 addition & 1 deletion packages/rest-typings/package.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,7 @@
"@rocket.chat/core-typings": "workspace:^",
"@rocket.chat/message-parser": "workspace:^",
"@rocket.chat/ui-kit": "workspace:~",
"ajv": "^8.17.1",
"ajv": "^8.20.0",
"ajv-formats": "^3.0.1"
},
"devDependencies": {
Expand Down
46 changes: 11 additions & 35 deletions yarn.lock
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9552,7 +9552,7 @@ __metadata:
"@types/express": "npm:^4.17.25"
"@types/jest": "npm:~30.0.0"
"@types/supertest": "npm:~6.0.3"
ajv: "npm:^8.17.1"
ajv: "npm:^8.20.0"
eslint: "npm:~9.39.4"
express: "npm:^4.21.2"
hono: "npm:4.12.25"
Expand Down Expand Up @@ -9700,7 +9700,7 @@ __metadata:
"@types/react": "npm:~18.3.28"
"@types/webpack-env": "npm:~1.18.8"
"@types/whatwg-fetch": "npm:~0.0.33"
ajv: "npm:^8.17.1"
ajv: "npm:^8.20.0"
ajv-formats: "npm:^3.0.1"
autoprefixer: "npm:^9.8.8"
babel-loader: "npm:~10.0.0"
Expand Down Expand Up @@ -9822,7 +9822,7 @@ __metadata:
"@rocket.chat/jest-presets": "workspace:~"
"@rocket.chat/tsconfig": "workspace:*"
"@types/jest": "npm:~30.0.0"
ajv: "npm:^8.17.1"
ajv: "npm:^8.20.0"
eslint: "npm:~9.39.4"
jest: "npm:~30.2.0"
typescript: "npm:~5.9.3"
Expand Down Expand Up @@ -10072,7 +10072,7 @@ __metadata:
"@types/xml-encryption": "npm:~1.2.4"
"@xmldom/xmldom": "npm:~0.8.13"
adm-zip: "npm:0.5.17"
ajv: "npm:^8.17.1"
ajv: "npm:^8.20.0"
ajv-formats: "npm:~3.0.1"
archiver: "npm:^7.0.1"
asterisk-manager: "npm:^0.2.0"
Expand Down Expand Up @@ -10759,7 +10759,7 @@ __metadata:
"@rocket.chat/message-parser": "workspace:^"
"@rocket.chat/ui-kit": "workspace:~"
"@types/jest": "npm:~30.0.0"
ajv: "npm:^8.17.1"
ajv: "npm:^8.20.0"
ajv-formats: "npm:^3.0.1"
eslint: "npm:~9.39.4"
mongodb: "npm:6.16.0"
Expand Down Expand Up @@ -16004,43 +16004,19 @@ __metadata:
languageName: node
linkType: hard

"ajv@npm:^6.12.4, ajv@npm:^6.12.5":
version: 6.12.6
resolution: "ajv@npm:6.12.6"
"ajv@npm:6.15.0":
version: 6.15.0
resolution: "ajv@npm:6.15.0"
dependencies:
fast-deep-equal: "npm:^3.1.1"
fast-json-stable-stringify: "npm:^2.0.0"
json-schema-traverse: "npm:^0.4.1"
uri-js: "npm:^4.2.2"
checksum: 10/48d6ad21138d12eb4d16d878d630079a2bda25a04e745c07846a4ad768319533031e28872a9b3c5790fa1ec41aabdf2abed30a56e5a03ebc2cf92184b8ee306c
checksum: 10/0916dda09c152fb5857bc1cc7ce61718e9cec5b7faeff44a74f5e324eed8a556e1a84856724ea322a067b436ecad9f74ac8295fd395449788cca52f0c25bd5fb
languageName: node
linkType: hard

"ajv@npm:^6.14.0":
version: 6.14.0
resolution: "ajv@npm:6.14.0"
dependencies:
fast-deep-equal: "npm:^3.1.1"
fast-json-stable-stringify: "npm:^2.0.0"
json-schema-traverse: "npm:^0.4.1"
uri-js: "npm:^4.2.2"
checksum: 10/c71f14dd2b6f2535d043f74019c8169f7aeb1106bafbb741af96f34fdbf932255c919ddd46344043d03b62ea0ccb319f83667ec5eedf612393f29054fe5ce4a5
languageName: node
linkType: hard

"ajv@npm:^8.0.0, ajv@npm:^8.0.1, ajv@npm:^8.17.1, ajv@npm:^8.9.0":
version: 8.17.1
resolution: "ajv@npm:8.17.1"
dependencies:
fast-deep-equal: "npm:^3.1.3"
fast-uri: "npm:^3.0.1"
json-schema-traverse: "npm:^1.0.0"
require-from-string: "npm:^2.0.2"
checksum: 10/ee3c62162c953e91986c838f004132b6a253d700f1e51253b99791e2dbfdb39161bc950ebdc2f156f8568035bb5ed8be7bd78289cd9ecbf3381fe8f5b82e3f33
languageName: node
linkType: hard

"ajv@npm:^8.18.0":
"ajv@npm:8.20.0, ajv@npm:^8.18.0, ajv@npm:^8.20.0":
version: 8.20.0
resolution: "ajv@npm:8.20.0"
dependencies:
Expand Down Expand Up @@ -33058,7 +33034,7 @@ __metadata:
"@types/fibers": "npm:^3.1.4"
"@types/node": "npm:~22.19.17"
"@types/ws": "npm:^8.18.1"
ajv: "npm:^8.17.1"
ajv: "npm:^8.20.0"
bcrypt: "npm:^6.0.0"
body-parser: "npm:^1.20.4"
colorette: "npm:^2.0.20"
Expand Down
Loading