fix(deps, frontend): update dependency ajv to v8.18.0 [security] by renovate-bot · Pull Request #6908 · apache/texera

renovate-bot · 2026-07-26T20:34:18Z

This PR contains the following updates:

Package	Change	Age	Confidence
ajv (source)	`8.10.0` → `8.18.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

ajv has ReDoS when using `$data` option

CVE-2025-69873 / GHSA-2g4f-4pwh-qvx6

More information

Details

ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Severity

CVSS Score: 5.5 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

ajv has ReDoS when using `$data` option

CVE-2025-69873 / GHSA-2g4f-4pwh-qvx6

More information

Details

ajv (Another JSON Schema Validator) through version 8.17.1 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to the JavaScript RegExp() constructor without validation. An attacker can inject a malicious regex pattern (e.g., \"^(a|a)*$\") combined with crafted input to cause catastrophic backtracking. A 31-character payload causes approximately 44 seconds of CPU blocking, with each additional character doubling execution time. This enables complete denial of service with a single HTTP request against any API using ajv with $data: true for dynamic schema validation.

Severity

CVSS Score: 5.5 / 10 (Medium)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ajv-validator/ajv (ajv)

`v8.18.0`

Compare Source

What's Changed

feat: allow tree-shaking by adding "sideEffects": false to package.json by @josdejong in #2480
fix: #2482 Infinity and NaN serialise to null by @jasoniangreen in #2487
fix: small grammatical error in managing-schemas.md by @monteiro-renato in #2508
fix: typos in schema-language.md by @monteiro-renato in #2507
fix(pattern): use configured RegExp engine with $data keyword to mitigate ReDoS attacks (CVE-2025-69873) by @epoberezkin in #2586

New Contributors

@josdejong made their first contribution in #2480
@monteiro-renato made their first contribution in #2508

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

`v8.17.1`

Compare Source

What's Changed

bump version to 8.17.1 by @jasoniangreen in #2472

Full Changelog: ajv-validator/ajv@v8.17.0...v8.17.1

Plus everything in 8.17.0 which failed to release

The only functional change is to switch from uri-js (which is no longer supported), to fast-uri. This is the second attempt and the team on fast-uri have been really helpful addressing the issues we found last time.

Revert "Revert fast-uri change (#2444)" by @gurgunday in #2448
fix: ignore new eslint error for @typescript-eslint/no-extraneous-class by @jasoniangreen in #2455
docs: clarify behaviour of addVocabulary by @jasoniangreen in #2454
docs: refactor to improve legibility by @blottn in #2432
Fix grammatical typo in managing-schemas.md by @wetneb in #2305
docs: Fix broken strict-mode link by @alexanderjsx in #2459
feat: add test for encoded refs and bump fast-uri by @jasoniangreen in #2449
fix: changes for @typescript-eslint/array-type rule by @jasoniangreen in #2467
fixes #2217 - clarify custom keyword naming by @jasoniangreen in #2457

`v8.16.0`

Compare Source

What's Changed

Revert fast-uri change by @jasoniangreen in #2444

Full Changelog: ajv-validator/ajv@v8.15.0...v8.16.0

`v8.15.0`

Compare Source

What's Changed

Replace uri-js with fast-uri by @vixalien in #2415
Bump to 8.15.0 by @jasoniangreen in #2442

New Contributors

@vixalien made their first contribution in #2415

Full Changelog: ajv-validator/ajv@v8.14.0...v8.15.0

`v8.14.0`

Compare Source

What's Changed

readme: build badge by @epoberezkin in #2424
Update workflows by @rotu in #2410
docs: add warning to maxLength / minLength by @jasoniangreen in #2428
fix: broken link in docs warning by @jasoniangreen in #2431
compileAsync a schema with discriminator and $ref, fixes #2427 by @jasoniangreen in #2433
bump version to 8.14.0 for publishing by @jasoniangreen in #2440

New Contributors

@rotu made their first contribution in #2410

Full Changelog: ajv-validator/ajv@v8.13.0...v8.14.0

`v8.13.0`

Compare Source

add named exports
update dependencies
update node.js

`v8.12.0`

Compare Source

fix JTD serialisation (remove leading comma in objects with only optional properties) (#2190, @piliugin-anton)
empty JTD "values" schema (#2191)
empty object to work with JTD utility type (#2158, @erikbrinkman)
fix JTD "discriminator" schema for objects with more than 8 properties (#2194)
correctly narrow "number" type to "integer" (#2192, @JacobLey)
update Node.js versions in CI to 14, 16, 18 and 19

`v8.11.2`

Compare Source

Update dependencies

Export ValidationError and MissingRefError (#1840, @dannyb648)

`v8.11.1`

Compare Source

Update dependencies

Export ValidationError and MissingRefError (#1840, @dannyb648)

`v8.11.0`

Compare Source

Use root schemaEnv when resolving references in oneOf (#1901, @asprouse)

Only use equal function in generated code when it is used (#1922, @bhvngt)

Configuration

📅 Schedule: (in timezone Etc/UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2026-07-26T20:34:29Z

👋 Thanks for opening this pull request, @renovate-bot!

It looks like the pull request description doesn't quite follow our template yet:

The What changes were proposed in this PR? section is missing; please keep the template's headings.
The How was this PR tested? section is missing; please keep the template's headings.
The Was this PR authored or co-authored using generative AI tooling? section is missing; please keep the template's headings.

Filling out the template helps reviewers understand and triage your contribution faster. Please edit the description to complete it. This message will disappear automatically once the template is followed.

You can find the template prompts by editing the description, or see CONTRIBUTING.md for the full contribution flow.

github-actions · 2026-07-26T20:34:37Z

Automated Reviewer Suggestions

Based on the git blame history of the changed files, we recommend the following reviewers:

No candidates found from git blame history.

codecov-commenter · 2026-07-26T20:42:56Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.92%. Comparing base (ee41d9a) to head (123f6f8).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #6908      +/-   ##
============================================
- Coverage     78.98%   77.92%   -1.07%     
+ Complexity     3786     3596     -190     
============================================
  Files          1160     1161       +1     
  Lines         46105    46046      -59     
  Branches       5115     5092      -23     
============================================
- Hits          36418    35881     -537     
- Misses         8067     8580     +513     
+ Partials       1620     1585      -35

Flag	Coverage Δ		*Carryforward flag
access-control-service	`70.00% <ø> (ø)`		Carriedforward from 1507bc0
agent-service	`76.76% <ø> (ø)`		Carriedforward from 1507bc0
amber	`70.08% <ø> (-2.13%)`	⬇️	Carriedforward from 1507bc0
computing-unit-managing-service	`20.49% <ø> (ø)`		Carriedforward from 1507bc0
config-service	`66.66% <ø> (ø)`		Carriedforward from 1507bc0
file-service	`67.21% <ø> (ø)`		Carriedforward from 1507bc0
frontend	`82.99% <ø> (ø)`
notebook-migration-service	`78.94% <ø> (ø)`		Carriedforward from 1507bc0
pyamber	`92.41% <ø> (-2.98%)`	⬇️	Carriedforward from 1507bc0
workflow-compiling-service	`54.81% <ø> (+28.49%)`	⬆️	Carriedforward from 1507bc0

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

ajv 8.18.0 replaced uri-js with fast-uri, so the bundled deps changed: - ajv 8.10.0 -> 8.18.0 - add fast-uri@3.1.4 (BSD-3-Clause) - drop uri-js@4.4.1 (no longer bundled; BSD-2-Clause section now empty) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

forking-renovate · 2026-07-27T22:23:36Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

Yicong-Huang · 2026-07-28T00:03:18Z

we need to backport. let's wait for a CI fix of backport

github-actions · 2026-07-29T01:33:19Z

Backport PR opened: draft #6984 (#6984) to release/v1.2, assigned to @renovate-bot — needs manual work because the cherry-pick conflicts.

Keep release/v1.2 versions (@vscode/iconv-lite-umd@0.7.0, quill@1.3.7) and apply only the #6908 intent: bump ajv to 8.18.0 and add its new fast-uri@3.1.4 dependency. Does not pull in main-only entries (parchment@3.0.0, quill@2.0.3).

Keep release/v1.2 versions (@vscode/iconv-lite-umd@0.7.0, quill@1.3.7) and apply only the #6908 intent: bump ajv to 8.18.0 and add its new fast-uri@3.1.4 dependency. Does not pull in main-only entries (parchment@3.0.0, quill@2.0.3).

#6984) ### What changes were proposed in this PR? Automated backport of #6908 to `release/v1.2`. Source: 469e8f0 · [automation run](https://github.com/apache/texera/actions/runs/30414369328) ### Any related issues, documentation, discussions? Backport of #6908. Fixes CVE-2025-69873 (see #6908 for details). ### How was this PR tested? Release-branch CI runs on this branch once the conflicts are resolved and this PR is marked ready for review. ### Was this PR authored or co-authored using generative AI tooling? No. --------- Co-authored-by: Mend Renovate <renovate@whitesourcesoftware.com> Co-authored-by: Xinyuan Lin <xinyual3@uci.edu> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Yicong Huang <17627829+Yicong-Huang@users.noreply.github.com>

…pache#7022) ### What changes were proposed in this PR? The `Report backport decisions` step in `backport-auto-label.yml` is skipped on every run, so the report comment and release-manager review request added in apache#6962 never fire. Root cause: the step's guard reads `steps.label.outputs.result`. `actions/github-script` always writes the script's return value to an output named `result` after the body runs. The `Label fix PRs` script has no `return`, so that post-run write blanks out the explicit `core.setOutput("result", …)` — the guard is therefore always false. Fix: rename the output to `decisions` (github-script only reserves `result`), and update the guard and the `RESULT` env reference to match. No logic in either step changes. ### Any related issues, documentation, discussions? Closes apache#7021. ### How was this PR tested? - Confirmed the failure on run `30423275226` (PR apache#7013): the `Report backport decisions` step shows `skipped`. - Verified 0 `` comments across apache#7013, apache#6983, apache#6958, apache#6908 (including PRs that were auto-labeled), confirming the step is systemically skipped. - Change is name-only; the report/review logic is untouched, so it runs unchanged once the guard sees the output. ### Was this PR authored or co-authored using generative AI tooling? Generated-by: Claude Code (Claude Opus 4.8) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

fix(deps, frontend): update dependency ajv to v8.18.0 [security]

3227a3e

forking-renovate Bot added dependencies Pull requests that update a dependency file release/v1.2 back porting to release/v1.2 security labels Jul 26, 2026

renovate-bot added dependencies Pull requests that update a dependency file release/v1.2 back porting to release/v1.2 security labels Jul 26, 2026

github-actions Bot assigned renovate-bot Jul 26, 2026

github-actions Bot added the frontend Changes related to the frontend GUI label Jul 26, 2026

Yicong-Huang approved these changes Jul 27, 2026

View reviewed changes

Yicong-Huang removed the release/v1.2 back porting to release/v1.2 label Jul 27, 2026

aglinxinyuan enabled auto-merge July 27, 2026 20:30

aglinxinyuan disabled auto-merge July 27, 2026 20:30

Merge branch 'main' into renovate/npm-ajv-vulnerability

cb21826

aglinxinyuan enabled auto-merge July 27, 2026 23:46

aglinxinyuan added this pull request to the merge queue Jul 27, 2026

Yicong-Huang removed this pull request from the merge queue due to a manual request Jul 28, 2026

Merge branch 'main' into renovate/npm-ajv-vulnerability

123f6f8

xuang7 added the release/v1.2 back porting to release/v1.2 label Jul 28, 2026

aglinxinyuan added this pull request to the merge queue Jul 29, 2026

Merged via the queue into apache:main with commit 469e8f0 Jul 29, 2026
41 checks passed

github-actions Bot mentioned this pull request Jul 29, 2026

fix(deps, frontend, v1.2): update dependency ajv to v8.18.0 [security] #6984

Merged

This was referenced Jul 29, 2026

Backport auto-label never posts its report comment or requests release-manager review: github-script output name collision clobbers steps.label.outputs.result #7021

Closed

fix(ci): rename backport auto-label output so its report step runs #7022

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix(deps, frontend): update dependency ajv to v8.18.0 [security] - #6908

fix(deps, frontend): update dependency ajv to v8.18.0 [security]#6908
aglinxinyuan merged 4 commits into
apache:mainfrom
renovate-bot:renovate/npm-ajv-vulnerability

renovate-bot commented Jul 26, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

codecov-commenter commented Jul 26, 2026 •

edited

Loading

Uh oh!

forking-renovate Bot commented Jul 27, 2026

Uh oh!

Uh oh!

Yicong-Huang commented Jul 28, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

renovate-bot commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ajv has ReDoS when using $data option

Details

Severity

References

ajv has ReDoS when using $data option

Details

Severity

References

Release Notes

What's Changed

New Contributors

What's Changed

Plus everything in 8.17.0 which failed to release

What's Changed

What's Changed

New Contributors

What's Changed

New Contributors

Configuration

Uh oh!

github-actions Bot commented Jul 26, 2026

Uh oh!

github-actions Bot commented Jul 26, 2026

Automated Reviewer Suggestions

Uh oh!

codecov-commenter commented Jul 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

forking-renovate Bot commented Jul 27, 2026

Edited/Blocked Notification

Uh oh!

Uh oh!

Yicong-Huang commented Jul 28, 2026

Uh oh!

Uh oh!

github-actions Bot commented Jul 29, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

renovate-bot commented Jul 26, 2026 •

edited

Loading

ajv has ReDoS when using `$data` option

ajv has ReDoS when using `$data` option

codecov-commenter commented Jul 26, 2026 •

edited

Loading