fix(deps): add npm override to resolve ajv ReDoS alert by ffmikha · Pull Request #160 · daydream-software/dnd-notes

ffmikha · 2026-05-08T13:26:33Z

Summary

Add a scoped npm overrides block in root package.json to force ajv >= 8.18.0 under the @rushstack/node-core-library subtree
Resolves Dependabot alert Issues in workflows #1: ajv ReDoS (CVE in ajv >= 7.0.0-alpha.0 < 8.18.0 when the $data option is used)
ESLint's ajv@6 tree is unaffected — the override is scoped to @rushstack/node-core-library only, not applied globally

Context

The vulnerable ajv@8.13.0 is pulled in transitively by:

packages/postgres-migrations -> umzug@3.8.2 -> @rushstack/ts-command-line
  -> @rushstack/terminal -> @rushstack/node-core-library@5.13.0 -> ajv@8.13.0

The $data option (required to trigger the vulnerability) is not used by this project or any of its toolchain dependencies, so the practical risk is low.

Lockfile note

@rushstack/node-core-library@5.13.0 declares "ajv": "~8.13.0" — a narrow pin. The npm override forcibly overrides this. The lockfile (package-lock.json) will be regenerated on the next npm install run. After merging, run npm install locally and commit the updated lockfile, or wait for Dependabot to regenerate it.

Test plan

npm ls ajv --all shows no ajv in the >=7.0.0-alpha.0 <8.18.0 range after lockfile is regenerated
npm run lint passes
npm run test:ci passes
npm audit --production reports no high/critical issues related to ajv

Closes #156
Part of epic #150

Summary by CodeRabbit

Chores
- Constrained a transitive validation dependency to a newer compatible release (ajv updated to ^8.18.0) via project configuration, improving dependency resolution and stability without other behavioral changes.

coderabbitai · 2026-05-08T13:26:45Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0ce77d17-dfcc-4609-a1d6-634f63a0bd79

📥 Commits

Reviewing files that changed from the base of the PR and between 902888d and 11d09c9.

⛔ Files ignored due to path filters (1)

package-lock.json is excluded by !**/package-lock.json, !package-lock.json

📒 Files selected for processing (1)

package.json

✅ Files skipped from review due to trivial changes (1)

package.json

📝 Walkthrough

Walkthrough

An overrides block is added to the root package.json forcing ajv@~8.13.0 to resolve to ^8.18.0.

Changes

AJV ReDoS Security Fix

Layer / File(s)	Summary
Dependency Override Configuration `package.json`	Adds an `overrides` entry that maps `ajv@~8.13.0` → `^8.18.0`.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	Title clearly summarizes the main change: adding an npm override to resolve ajv ReDoS vulnerability alert, which is directly reflected in the changeset.
Linked Issues check	✅ Passed	PR successfully implements all coding requirements from issue `#156`: identifies vulnerable ajv dependency, applies npm override to enforce ajv@^8.18.0 scoped to `@rushstack/node-core-library`, and enables verification steps.
Out of Scope Changes check	✅ Passed	All changes are scoped to the stated objective: only the package.json overrides configuration was modified to address the ajv ReDoS vulnerability with no extraneous additions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/156-ajv-redos

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

package.json (1)
83-83: ⚡ Quick win

Prefer a bounded override range to avoid unintended future major upgrades.

Using >=8.18.0 can pull ajv@9+ later under this subtree. Consider ^8.18.0 (or an exact 8.x pin) to keep this security fix stable while avoiding surprise compatibility drift.
Suggested change
-      "ajv": ">=8.18.0"
+      "ajv": "^8.18.0"
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@package.json` at line 83, The AJV dependency version range in package.json is
unbounded ( "ajv": ">=8.18.0" ); change it to a bounded 8.x range such as "ajv":
"^8.18.0" (or pin to an exact 8.x version) to prevent accidental upgrades to AJV
v9 while preserving the security fix—update the "ajv" entry accordingly and run
dependency install/update to lock the new range.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@package.json`:
- Around line 81-85: You added an overrides entry for
"@rushstack/node-core-library" to force "ajv" >=8.18.0 but did not regenerate
the lockfile; run npm install to update package-lock.json so the override is
applied (ensuring `@rushstack/node-core-library`'s transitive ajv is bumped to
8.18.0+), verify the lockfile now lists the updated ajv version, and commit the
updated package-lock.json alongside the package.json change.

---

Nitpick comments:
In `@package.json`:
- Line 83: The AJV dependency version range in package.json is unbounded (
"ajv": ">=8.18.0" ); change it to a bounded 8.x range such as "ajv": "^8.18.0"
(or pin to an exact 8.x version) to prevent accidental upgrades to AJV v9 while
preserving the security fix—update the "ajv" entry accordingly and run
dependency install/update to lock the new range.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: aa877d11-2aaa-4f75-89b6-6416f66112e2

📥 Commits

Reviewing files that changed from the base of the PR and between ad63fc8 and 902888d.

📒 Files selected for processing (1)

package.json

Add a scoped override for @rushstack/node-core-library to force ajv >=8.18.0, resolving the Dependabot ReDoS alert (CVE in ajv >=7.0.0-alpha.0 <8.18.0 when the $data option is used). ESLint's ajv@6 tree is unaffected because the override is scoped to the rushstack subtree only. Run `npm install` after merging to regenerate the lockfile with the resolved version. Closes #156 Part of #150 Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Switch override key from nested-object form (which npm 10 does not honour against a ~8.13.0 constraint) to the flat version-selector form `ajv@~8.13.0`, which correctly forces hoisting to ^8.18.0. The nested `@rushstack/node-core-library/node_modules/ajv` entry is removed from the lockfile; ajv@8.20.0 is now shared from the root. `npm audit` reports 0 vulnerabilities for the ajv ReDoS advisory. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

ffmikha · 2026-05-08T14:04:06Z

Both CodeRabbit points addressed:

Range bounded to ^8.18.0 — with a structural correction

The original override used the nested-object form { "@rushstack/node-core-library": { "ajv": ">=8.18.0" } }. After extensive testing with npm 10.9.4, that form does not force re-resolution against a ~8.13.0 constraint — the lockfile kept pinning ajv@8.13.0 under @rushstack/node-core-library even after a full clean install (rm -rf node_modules package-lock.json && npm install). npm audit still reported the ReDoS advisory unchanged.

Switched to the flat version-selector form instead:

"overrides": {
  "ajv@~8.13.0": "^8.18.0"
}

This matches only packages requesting ~8.13.0 (which is exactly @rushstack/node-core-library@5.13.0 — no other package in the tree requests that range). ESLint's ^6.x ajv tree is unaffected.

Lockfile regenerated — advisory cleared

After a clean install with the corrected override:

node_modules/@rushstack/node-core-library/node_modules/ajv entry is gone from the lockfile — deduped into the hoisted node_modules/ajv@8.20.0
npm ls ajv --all | grep "ajv@8\.(13|17)" returns empty
npm audit reports 0 vulnerabilities (was 6 moderate)

Commit: 11d09c9

ffmikha · 2026-05-08T14:14:36Z

@coderabbitai review

coderabbitai · 2026-05-08T14:14:43Z

✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

…ons.md PR refs Update the console.error spy in app.test.ts to use util.format so it correctly captures formatted output when production code calls console.error with a format-string + args (the secure CodeQL-safe form). Fix decisions.md to consistently reference PR #160 (the fix) and issue #156 (the Dependabot alert) in the ajv ReDoS override decision entry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

…163) * fix(security): close remaining Epic #150 CodeQL alerts Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * chore(squad): log Epic #150 session, merge decisions inbox Logged Epic #150 (CodeQL + Dependabot security alerts) session with work summary: - Brand: #151 gitleaks, #155 k3d hardening, #156 ajv override (6 PRs merged) - Data: #154 keycloak-jwt, #153 format-string, #152 rate-limit, #163 cleanup - Lead: triage, routing, CodeRabbit shepherding, alert audit Merged 4 decisions from inbox: 1. npm override selector syntax rule (nested-object fails on tilde-pins in npm 10.9.4) 2. CodeQL false-positive dismissal pattern for dev-only scripts with loopback guards 3. Rate-limit policy table (auth 5/15min, write 100/15min, read 300/15min) 4. Rate-limit zero-semantics wrapper (limit=0 via makeRateLimiter preserves disable) Dismissed alerts: CodeQL #5 + #6 (k3d SSRF false positives, dev-only loopback proxy). Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com> * fix(rate-limit): suppress trust-proxy validation warning express-rate-limit v8 emits a ValidationError to stderr when trust proxy is enabled, polluting captured log output in tests. Trust-proxy is intentional in this k3d deployment; add validate: { trustProxy: false } to rateLimitDefaults in both apps to suppress the runtime warning. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> * test(control-plane): use util.format in console.error spy; fix decisions.md PR refs Update the console.error spy in app.test.ts to use util.format so it correctly captures formatted output when production code calls console.error with a format-string + args (the secure CodeQL-safe form). Fix decisions.md to consistently reference PR #160 (the fix) and issue #156 (the Dependabot alert) in the ajv ReDoS override decision entry. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

ffmikha mentioned this pull request May 8, 2026

Epic: resolve code scanning and Dependabot security alerts #150

Closed

6 tasks

coderabbitai Bot requested changes May 8, 2026

View reviewed changes

Comment thread package.json

ffmikha and others added 2 commits May 8, 2026 09:43

ffmikha force-pushed the fix/156-ajv-redos branch from 902888d to 11d09c9 Compare May 8, 2026 14:03

coderabbitai Bot approved these changes May 8, 2026

View reviewed changes

ffmikha merged commit 6e3e1a5 into main May 8, 2026
9 checks passed

ffmikha deleted the fix/156-ajv-redos branch May 8, 2026 14:17

coderabbitai Bot mentioned this pull request May 8, 2026

fix(security): close remaining post-merge CodeQL alerts (Epic #150) #163

Merged

3 tasks

Navigation Menu

Uh oh!

fix(deps): add npm override to resolve ajv ReDoS alert - #160

fix(deps): add npm override to resolve ajv ReDoS alert#160
ffmikha merged 2 commits into
mainfrom
fix/156-ajv-redos

ffmikha commented May 8, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 8, 2026 •

edited

Loading

Walkthrough

Changes

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

ffmikha commented May 8, 2026

Uh oh!

ffmikha commented May 8, 2026

Uh oh!

coderabbitai Bot commented May 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

ffmikha commented May 8, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Lockfile note

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ffmikha commented May 8, 2026

Uh oh!

ffmikha commented May 8, 2026

Uh oh!

coderabbitai Bot commented May 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

ffmikha commented May 8, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 8, 2026 •

edited

Loading