Skip to content

Bump jsonpath-plus and @stoplight/spectral-core - #83

Closed
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-2142883b9f
Closed

Bump jsonpath-plus and @stoplight/spectral-core#83
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/multi-2142883b9f

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Contributor

Bumps jsonpath-plus and @stoplight/spectral-core. These dependencies needed to be updated together.
Updates jsonpath-plus from 7.1.0 to 10.4.0

Release notes

Sourced from jsonpath-plus's releases.

v10.4.0

What's Changed

New Contributors

Full Changelog: JSONPath-Plus/JSONPath@v10.3.0...v10.4.0

v10.3.0

What's Changed

Full Changelog: JSONPath-Plus/JSONPath@v10.2.0...v10.3.0

v7.2.0

7.2.0 (2022-09-02)

Changelog

Sourced from jsonpath-plus's changelog.

10.4.0

10.3.0

  • fix(eval): rce using non-string prop names (#237)
  • feat(demo): make demo link shareable (#238)
  • chore: update deps. and devDeps.

10.2.0

  • fix(eval): improve security of safe-eval (#233)
  • chore: update deps. and devDeps.

10.1.0

  • feat: add typeof operator to safe script

10.0.7

  • fix(security): prevent constructor access
  • docs: add security policy file

10.0.6

  • fix(security): prevent call/apply invocation of Function

10.0.5

  • fix: remove overly aggressive disabling of native functions but disallow __proto__

10.0.4

  • fix(security): further prevent binding of Function calls which may evade detection

10.0.3

  • fix(security): prevent binding of Function calls which may evade detection

10.0.2

  • fix(security): prevent Function calls outside of member expressions

... (truncated)

Commits
  • 0bedaea chore: bump version
  • 3e597e5 chore(coverage): ignore Function guard from coverage as it is unreachable
  • 1bab1cc fix(eval): rce using lookupGetter or lookupSetter
  • 5d3d63e build(deps): bump lodash from 4.17.21 to 4.17.23 (#249)
  • 233d754 chore: update security policy (#250)
  • d8dad28 build(deps): bump qs from 6.14.0 to 6.14.1 (#248)
  • c78a9b6 chore: update devDeps. and lock file
  • 106d243 feat: add void operator (#244)
  • 235b283 chore: remove lgtm file and update devDeps.
  • b92ebbf chore: update devDeps.
  • Additional commits viewable in compare view
Maintainer changes

This version was pushed to npm by 80avin, a new releaser for jsonpath-plus since your current version.


Updates @stoplight/spectral-core from 1.18.3 to 1.23.0

Commits
  • 32f0ce9 chore(release): 1.23.0 [skip ci]
  • 2f861c3 chore(release): 6.16.0 [skip ci]
  • def8a2d chore(release): 1.22.2 [skip ci]
  • 04c1db3 feat(core): add error line number for yaml and json ruleset validation (#2945)
  • 6666ccc fix(rulesets): fix handling relative references in externalValue (#2944)
  • 05f0c54 chore(deps): bump follow-redirects from 1.15.6 to 1.16.0 (#2941)
  • e473828 chore(release): 1.1.5 [skip ci]
  • eeb01f2 chore(release): 1.10.2 [skip ci]
  • bf530dd fix(deps): post lodash update changes for semantic release (#2942)
  • 3ad81f9 chore(release): 1.22.1 [skip ci]
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [jsonpath-plus](https://github.com/s3u/JSONPath) and [@stoplight/spectral-core](https://github.com/stoplightio/spectral). These dependencies needed to be updated together.

Updates `jsonpath-plus` from 7.1.0 to 10.4.0
- [Release notes](https://github.com/s3u/JSONPath/releases)
- [Changelog](https://github.com/JSONPath-Plus/JSONPath/blob/main/CHANGES.md)
- [Commits](JSONPath-Plus/JSONPath@v7.1.0...v10.4.0)

Updates `@stoplight/spectral-core` from 1.18.3 to 1.23.0
- [Release notes](https://github.com/stoplightio/spectral/releases)
- [Changelog](https://github.com/stoplightio/spectral/blob/develop/CHANGELOG.md)
- [Commits](https://github.com/stoplightio/spectral/compare/@stoplight/spectral-core-1.18.3...@stoplight/spectral-core-1.23.0)

---
updated-dependencies:
- dependency-name: jsonpath-plus
  dependency-version: 10.4.0
  dependency-type: indirect
- dependency-name: "@stoplight/spectral-core"
  dependency-version: 1.23.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 29, 2026
@jmlue42 jmlue42 closed this Jun 29, 2026
@dependabot @github

dependabot Bot commented on behalf of github Jun 29, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/npm_and_yarn/multi-2142883b9f branch June 29, 2026 22:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant