@apidevtools/json-schema-ref-parser - npm Package Compare versions

Comparing version 11.1.1 to 11.2.0

dist/lib/bundle.js

@@ -139,13 +139,13 @@ "use strict";
     inventory.push({
-        $ref,
-        parent: $refParent,
-        key: $refKey,
-        pathFromRoot,
-        depth,
-        file,
-        hash,
-        value: pointer.value,
-        circular: pointer.circular,
-        extended,
-        external,
+        $ref, // The JSON Reference (e.g. {$ref: string})
+        parent: $refParent, // The object that contains this $ref pointer
+        key: $refKey, // The key in `parent` that is the $ref pointer
+        pathFromRoot, // The path to the $ref pointer, from the JSON Schema root
+        depth, // How far from the JSON Schema root is this $ref pointer?
+        file, // The file that the $ref pointer resolves to
+        hash, // The hash within `file` that the $ref pointer resolves to
+        value: pointer.value, // The resolved value of the $ref pointer
+        circular: pointer.circular, // Is this $ref pointer DIRECTLY circular? (i.e. it references itself)
+        extended, // Does this $ref extend its resolved value? (i.e. it has extra properties, in addition to "$ref")
+        external, // Does this $ref pointer point to a file other than the main JSON Schema file?
         indirections, // The number of indirect references that were traversed to resolve the value
@@ -152,0 +152,0 @@ });

dist/lib/dereference.js

@@ -92,3 +92,3 @@ "use strict";
                             if (options.dereference.onDereference) {
-                                options.dereference.onDereference(value.$ref, obj[key]);
+                                options.dereference.onDereference(value.$ref, obj[key], obj, key);
                             }
@@ -95,0 +95,0 @@ }

dist/lib/options.d.ts

@@ -68,6 +68,8 @@ import type { HTTPResolverOptions, JSONSchemaObject, Plugin, ResolverOptions } from "./types/index.js";
          *
-         * @argument {string} path The path being dereferenced (ie. the `$ref` string).
-         * @argument {JSONSchemaObject} object The JSON-Schema that the `$ref` resolved to.
+         * @argument {string} path - The path being dereferenced (ie. the `$ref` string)
+         * @argument {JSONSchemaObject} value - The JSON-Schema that the `$ref` resolved to
+         * @argument {JSONSchemaObject} parent - The parent of the dereferenced object
+         * @argument {string} parentPropName - The prop name of the parent object whose value was dereferenced
          */
-        onDereference?(path: string, value: JSONSchemaObject): void;
+        onDereference?(path: string, value: JSONSchemaObject, parent?: JSONSchemaObject, parentPropName?: string): void;
         /**
@@ -74,0 +76,0 @@ * Whether a reference should resolve relative to its directory/path, or from the cwd

dist/lib/options.js

@@ -94,3 +94,4 @@ "use strict";
     if (isMergeable(source)) {
-        const keys = Object.keys(source);
+        // prevent prototype pollution
+        const keys = Object.keys(source).filter((key) => !["__proto__", "constructor", "prototype"].includes(key));
         for (let i = 0; i < keys.length; i++) {
@@ -97,0 +98,0 @@ const key = keys[i];

dist/lib/parsers/yaml.js

@@ -24,3 +24,3 @@ "use strict";
      */
-    canParse: [".yaml", ".yml", ".json"],
+    canParse: [".yaml", ".yml", ".json"], // JSON is valid YAML
     /**
@@ -27,0 +27,0 @@ * Parses the given file as YAML

dist/lib/resolvers/http.js

@@ -47,3 +47,3 @@ "use strict";
      */
-    timeout: 5000,
+    timeout: 5000, // 5 seconds
     /**
@@ -50,0 +50,0 @@ * The maximum number of HTTP redirects to follow.

lib/dereference.ts

@@ -110,3 +110,3 @@ import $Ref from "./ref.js";
               if (options.dereference.onDereference) {
-                options.dereference.onDereference(value.$ref, obj[key]);
+                options.dereference.onDereference(value.$ref, obj[key], obj, key);
               }
@@ -113,0 +113,0 @@ }

lib/options.ts

@@ -82,6 +82,8 @@ import jsonParser from "./parsers/json.js";
      *
-     * @argument {string} path The path being dereferenced (ie. the `$ref` string).
-     * @argument {JSONSchemaObject} object The JSON-Schema that the `$ref` resolved to.
+     * @argument {string} path - The path being dereferenced (ie. the `$ref` string)
+     * @argument {JSONSchemaObject} value - The JSON-Schema that the `$ref` resolved to
+     * @argument {JSONSchemaObject} parent - The parent of the dereferenced object
+     * @argument {string} parentPropName - The prop name of the parent object whose value was dereferenced
      */
-    onDereference?(path: string, value: JSONSchemaObject): void;
+    onDereference?(path: string, value: JSONSchemaObject, parent?: JSONSchemaObject, parentPropName?: string): void;
 
@@ -184,3 +186,4 @@ /**
   if (isMergeable(source)) {
-    const keys = Object.keys(source);
+    // prevent prototype pollution
+    const keys = Object.keys(source).filter((key) => !["__proto__", "constructor", "prototype"].includes(key));
     for (let i = 0; i < keys.length; i++) {
@@ -187,0 +190,0 @@ const key = keys[i];

package.json

 {
   "name": "@apidevtools/json-schema-ref-parser",
-  "version": "11.1.1",
+  "version": "11.2.0",
   "description": "Parse, Resolve, and Dereference JSON Schema $ref pointers",
@@ -60,3 +60,3 @@ "keywords": [
     "lint": "eslint lib",
-    "build": "rm -fr dist/* && tsc",
+    "build": "rimraf dist && tsc",
     "typecheck": "tsc --noEmit",
@@ -71,29 +71,30 @@ "prettier": "prettier --write \"**/*.+(js|jsx|ts|tsx|har||json|css|md)\"",
   "devDependencies": {
-    "@types/eslint": "8.44.2",
-    "@types/js-yaml": "^4.0.6",
-    "@types/node": "^20.6.2",
-    "@typescript-eslint/eslint-plugin": "^6.7.2",
-    "@typescript-eslint/eslint-plugin-tslint": "^6.7.2",
-    "@typescript-eslint/parser": "^6.7.2",
-    "@vitest/coverage-v8": "^0.34.4",
+    "@types/eslint": "8.56.5",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^20.11.24",
+    "@typescript-eslint/eslint-plugin": "^7.1.1",
+    "@typescript-eslint/eslint-plugin-tslint": "^7.0.2",
+    "@typescript-eslint/parser": "^7.1.1",
+    "@vitest/coverage-v8": "^1.3.1",
     "abortcontroller-polyfill": "^1.7.5",
     "cross-env": "^7.0.3",
-    "eslint": "^8.49.0",
-    "eslint-config-prettier": "^9.0.0",
+    "eslint": "^8.57.0",
+    "eslint-config-prettier": "^9.1.0",
     "eslint-config-standard": "^17.1.0",
-    "eslint-plugin-import": "^2.28.1",
-    "eslint-plugin-prettier": "^5.0.0",
+    "eslint-plugin-import": "^2.29.1",
+    "eslint-plugin-prettier": "^5.1.3",
     "eslint-plugin-promise": "^6.1.1",
-    "eslint-plugin-unused-imports": "^3.0.0",
-    "jsdom": "^22.1.0",
-    "lint-staged": "^14.0.1",
+    "eslint-plugin-unused-imports": "^3.1.0",
+    "jsdom": "^24.0.0",
+    "lint-staged": "^15.2.2",
     "node-fetch": "^3.3.2",
-    "prettier": "^3.0.3",
-    "typescript": "^5.2.2",
-    "vitest": "^0.34.4"
+    "prettier": "^3.2.5",
+    "rimraf": "^5.0.5",
+    "typescript": "^5.3.3",
+    "vitest": "^1.3.1"
   },
   "dependencies": {
     "@jsdevtools/ono": "^7.1.3",
-    "@types/json-schema": "^7.0.13",
-    "@types/lodash.clonedeep": "^4.5.7",
+    "@types/json-schema": "^7.0.15",
+    "@types/lodash.clonedeep": "^4.5.9",
     "js-yaml": "^4.1.0",
@@ -112,3 +113,4 @@ "lodash.clonedeep": "^4.5.0"
     ]
-  }
+  },
+  "packageManager": "yarn@4.1.1"
 }

New alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Fixed alerts

License Policy Violation

License

This package is not allowed per your license policy. Review the package's license to ensure compliance.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

308658

increased by0.48%

Lines of code

7152

increased by0.08%

Worsened metrics

Dev dependency count

23

increased by4.55%

Dependency changes

• Updated@types/json-schema@^7.0.15

• Updated@types/lodash.clonedeep@^4.5.9