Security: Upgrade schema-utils to v4 to resolve ajv CVE-2025-69873 (GHSA-2g4f-4pwh-qvx6)

[oliver-lister-sj]

Description

fork-ts-checker-webpack-plugin currently depends on schema-utils version ^3.1.1, which internally depends on ajv version ^6.12.5 (resolving to 6.12.6). This version of ajv has a ReDoS (Regular Expression Denial of Service) security vulnerability.

Security Advisory

• CVE: CVE-2025-69873
• GitHub Advisory: GHSA-2g4f-4pwh-qvx6
• Severity: Moderate / High (CVSS 7.5)
• Fixed in: ajv 8.18.0

Dependency Chain

  fork-ts-checker-webpack-plugin@9.1.0
  └── schema-utils@3.3.0
      └── ajv@6.12.6 ← VULNERABLE

Proposed Solution

Upgrade schema-utils from ^3.1.1 to ^4.0.0 or higher. schema-utils 4.x uses ajv 8.x which includes the security fix.

Environment

• fork-ts-checker-webpack-plugin version: 9.1.0
• Node.js version: 20.x
• Webpack version: 5.94.0

Additional Context

While this vulnerability requires specific conditions to exploit ($data option enabled with untrusted input), security scanners flag this as a vulnerability, causing issues with compliance and CI/CD pipelines.

Related: webpack/schema-utils#191