Bump dependency due to a vulnerable package

[anaezes]

A dependency used in this project @apidevtools/json-schema-ref-parser is vulnerable to a prototype pollution attack, as listed in https://nvd.nist.gov/vuln/detail/CVE-2024-29651 - https://github.com/advisories/GHSA-5f97-h2c2-826q

We should bump this dependency in order to avoid any potential vulnerabilities, and to prevent vulnerability alarms by automated CVE analysis in this project.

[jayvdb]

Noting that this project currently is pinning @apidevtools/json-schema-ref-parser@9.0.6 , which is not in the vulnerable range of the CVE.

[jayvdb]

Actually, I did a bit more analysis of this vuln and I believe it effected version @apidevtools/json-schema-ref-parser@9.0.6 , and many prior.

The fix here fix(prototype): prevent prototype pollution · APIDevTools/json-schema-ref-parser@8cad7f7 is

    -const keys = Object.keys(source);
    +// prevent prototype pollution
    +const keys = Object.keys(source).filter((key) => !["__proto__", "constructor", "prototype"].includes(key));

And the line const keys = Object.keys(source) goes much further back.

There was a rewrite of .js → .ts , and that line appeared in the JS version:

https://github.com/APIDevTools/json-schema-ref-parser/commit/a5b3946fbb62683ab69e3747a8893014591726af

We see it goes back to v3 at least here

https://github.com/APIDevTools/json-schema-ref-parser/commit/2d5b52c75242b1caeebe4ada710421b9d5eba3d9#diff-358c9491edc00f0db6f2f3c317df9aa932135803481b86c9289bd56bf8af0622R103