spectral @stoplight/spectral-core depends on jsonpath-plus <10

@stoplight/spectral-core depends on jsonpath-plus <10

Open jacquesg opened this issue 1 year ago • 7 comments

trafficstars

Describe the bug See: https://github.com/advisories/GHSA-pppg-cpfq-h7wr

Oct 14 '24 18:10 jacquesg

With 5205058d1c9b48e6785b7744e2e2716cc7f1e0f4 merged, could a new release be cut?

Oct 16 '24 13:10 jacquesg

@jacquesg When can we expect a patch release?

Oct 17 '24 03:10 parithibang

"nimma": "0.2.2",

This dependency nimma depends on jsonpath-plus with version ^6.0.1 (optional dependency).

The latest version is 7.0.0 and since 4.0.0, it's only a dev dependency and no optional dependency anymore.

Oct 17 '24 11:10 pjungermann

@jacquesg When can we expect a patch release?

Oct 18 '24 07:10 Mariscal6

I'm not the maintainer, I asked the same question :)

Oct 18 '24 08:10 jacquesg

A new version of nimma in the 0.2 series is now available: https://www.npmjs.com/package/nimma/v/0.2.3

Oct 20 '24 18:10 jacquesg

Added a PR to bump the dependency #2712

Oct 20 '24 18:10 jacquesg