Skip to content

fix: remove stale z-schema resolution, dropping unused validator dependency#15723

Merged
acoates-ms merged 1 commit intomicrosoft:mainfrom
PHILLIPS71:fix/remove-stale-z-schema-validator-resolution
Mar 4, 2026
Merged

fix: remove stale z-schema resolution, dropping unused validator dependency#15723
acoates-ms merged 1 commit intomicrosoft:mainfrom
PHILLIPS71:fix/remove-stale-z-schema-validator-resolution

Conversation

@PHILLIPS71
Copy link
Contributor

@PHILLIPS71 PHILLIPS71 commented Mar 4, 2026

Description

The PR removes the outdated z-schema resolution, which in turn leaves the transitive validator dependency orphaned.

I’m not sure whether this also needs to be cherry-picked into the v0.79 and v0.80 stable branches, but the first step would be getting it fixed on main.

Type of Change

  • Bug fix (non-breaking change which fixes an issue)

Why

The z-schema resolution was originally added to mitigate CVE-2021-3765 in the validator package, which was pulled in transitively via rush (a dependency of lage). lage no longer depends on rush / z-schema, making the resolution and its transitive packages orphaned in the dependency tree.

Resolves #15460, #15461

What

  • removed z-schema from resolutions in package.json
  • removed the accompanying resolutions.justification entry
  • ran yarn to update yarn.lock, dropping problematic validator package

Screenshots

N/A

Testing

N/A

Changelog

no

Microsoft Reviewers: Open in CodeFlow

@PHILLIPS71 PHILLIPS71 requested a review from a team as a code owner March 4, 2026 06:48
@acoates-ms
Copy link
Contributor

/azp run

@azure-pipelines
Copy link

Azure Pipelines successfully started running 2 pipeline(s).

@acoates-ms acoates-ms merged commit 4111f96 into microsoft:main Mar 4, 2026
46 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[0.80]Component Governance critical alert Upgrade validator from 13.15.15 to 13.15.22 to fix the vulnerability.

2 participants