Ajv-merge-patch, a valuable extension for the Ajv JSON Schema validator, simplifies schema composition through the $merge and $patch keywords. Version 5.0.1 and its predecessor, 5.0.0, share the same core functionality, providing developers with a convenient way to extend and modify existing schemas. Both versions are compatible with Ajv version 8.0.0 or later, ensuring seamless integration into modern JavaScript projects. They offer a consistent set of developer tools, including ESLint for code linting, Mocha for testing, and NYC for coverage analysis.
The key difference between the two versions lies in their dependencies. While both rely on fast-json-patch for JSON Patch operations, they specify different versions of json-merge-patch. Version 5.0.0 depends on json-merge-patch version 0.2.3, while version 5.0.1 upgrades this dependency to version 1.0.2. This upgrade introduces potential improvements in merge patch handling, possibly addressing bugs or enhancing performance. Developers should consider this dependency update when choosing between the two versions, particularly if their projects involve intricate or extensive schema merging and patching. The upgrade in json-merge-patch might offer better compatibility with certain edge cases or newer standards. Ultimately, the selection depends on the specific requirements and priorities of your project. Always test thoroughly after upgrading dependencies.
All the vulnerabilities related to the version 5.0.1 of the package
Starcounter-Jack JSON-Patch Prototype Pollution vulnerability
A vulnerability has been found in Starcounter-Jack JSON-Patch up to 3.1.0 and classified as problematic. This vulnerability affects unknown code. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.1 can address this issue. The name of the patch is 7ad6af41eabb2d799f698740a91284d762c955c9. It is recommended to upgrade the affected component. VDB-216778 is the identifier assigned to this vulnerability.
