Release a new package to include the patch for CVE-2024-21534 critical vulnerability

[bo-acc]

Chore summary
Release a new package to include the patch for CVE-2024-21534 critical vulnerability covered in #2709

Tasks

• Test json-path v10.0.0
• Release a new package

Additional context
N/A

[mnaumanali94]

We're working on a pipeline problem to fix this and get it released. The ETA is early next week.

[bo-acc]

I highly appreciate your prompt response and dedication on the open-source work. Thank you!

[jacquesg]

Hi @mnaumanali94, manage to get the pipeline problem fixed? Would really appreciate a new release of this :)

[bkmu]

@mnaumanali94 Is there anything the rest of the community can do to help support getting the pipeline issue resolved? I too am sitting tight awaiting the new release and would be willing to help troubleshoot whatever is going on!

[jacquesg]

Can we reopen this issue?

[mnaumanali94]

@jacquesg Apologies for the delay here. We should have it out tomorrow. The team got pulled into some other things. 🙏🏼

I'll post the details here as we get it out.

[jacquesg]

@jacquesg Apologies for the delay here. We should have it out tomorrow. The team got pulled into some other things. 🙏🏼

I'll post the details here as we get it out.

Thank you @mnaumanali94, appreciate the effort.

[mnaumanali94]

@jacquesg @bkmu @bo-acc The new release should be out. Let me know if y'all see any issues with that.

[bo-acc]

Thank you so much!

[davidensinger]

@mnaumanali94 Hi, sorry for bringing this issue back from the dead, but jsonpath-plus@10.1.0 unfortunately doesn’t fix the vulnerability. The latest version, 10.2.0, does remediation the security issue.

See:

• https://snyk.io/advisor/npm-package/jsonpath-plus
• and some discussion in the jsonpath-plus repo about this.

Would you please update the version or use a caret ^ for jsonpath-plus for https://github.com/stoplightio/spectral/blob/develop/packages/core/package.json#L50 or would you accept a PR?

Thank you for your time on this too.

[frankkilcommins]

Thanks for reporting @davidensinger - we'll take a look.