chore(deps): bump ajv from 8.17.1 to 8.18.0

[dependabot]

Bumps ajv from 8.17.1 to 8.18.0.

Release notes

Sourced from ajv's releases.

v8.18.0

What's Changed

• feat: allow tree-shaking by adding "sideEffects": false to package.json by @​josdejong in ajv-validator/ajv#2480
• fix: #2482 Infinity and NaN serialise to null by @​jasoniangreen in ajv-validator/ajv#2487
• fix: small grammatical error in managing-schemas.md by @​monteiro-renato in ajv-validator/ajv#2508
• fix: typos in schema-language.md by @​monteiro-renato in ajv-validator/ajv#2507
• fix(pattern): use configured RegExp engine with $data keyword to mitigate ReDoS attacks (CVE-2025-69873) by @​epoberezkin in ajv-validator/ajv#2586

New Contributors

• @​josdejong made their first contribution in ajv-validator/ajv#2480
• @​monteiro-renato made their first contribution in ajv-validator/ajv#2508

Full Changelog: ajv-validator/ajv@v8.17.1...v8.18.0

Commits

• 142ce84 8.18.0
• 720a23f fix(pattern): use configured RegExp engine with $data keyword to mitigate ReD...
• 82735a1 fix: typos in schema-language.md (#2507)
• b17ec32 fix: small grammatical error in managing-schemas.md (#2508)
• 69568d0 fix: #2482 Infinity and NaN serialise to null (#2487)
• f06766f feat: allow tree-shaking by adding ``"sideEffects": falsetopackage.json` ...
• See full diff in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[rtibbles]

@dependabot rebase

[rtibblesbot]

Dependency Update Review

Package: ajv 8.17.1 → 8.18.0
Semver risk: Minor
Dependency type: Production
CI status: Contributor check fails (expected for bot PRs); substantive checks (frontend tests, linting, build) still in progress

Changelog Analysis

Sources consulted:

• Release notes v8.18.0
• Compare v8.17.1...v8.18.0

Breaking changes: None.

Security fixes:

• CVE-2025-69873: ReDoS mitigation — pattern validation now uses the configured RegExp engine with $data keyword (ajv-validator/ajv#2586)

Other notable changes:

• Tree-shaking support via "sideEffects": false in package.json
• Fix: Infinity and NaN values no longer serialize incorrectly to null (#2482)

Compatibility Assessment

• Breaking changes: none
• Peer dependency changes: none
• Code changes required: none
• Lockfile changes: ajv 8.17.1 → 8.18.0 and transitive dep fast-uri 3.0.6 → 3.1.0 — expected
• Target branch: unstable (default branch) — correct

Recommendation

APPROVE once CI completes — minor bump with no breaking changes and a security fix (CVE-2025-69873). The Infinity/NaN serialization fix is a correctness improvement. Recommend merging promptly given the CVE.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Reviewed the pull request diff checking for:

• Correctness: bugs, edge cases, undocumented behavior, resource leaks, hardcoded values
• Design: unnecessary complexity, naming, readability, comment accuracy, redundant state
• Architecture: duplicated concerns, minimal interfaces, composition over inheritance
• Testing: behavior-based assertions, mocks only at hard boundaries, accurate coverage
• Completeness: missing dependencies, unupdated usages, i18n, accessibility, security
• Principles: DRY (same reason to change), SRP, Rule of Three (no premature abstraction)
• Checked CI status and linked issue acceptance criteria
• For UI changes: inspected screenshots for layout, visual completeness, and consistency

[rtibblesbot]

Minor dependency bump (ajv 8.17.1 → 8.18.0) with a security fix (CVE-2025-69873 ReDoS mitigation), no breaking changes.

CI: frontend tests, linting, and build still in progress; path checks and message build passing. Target branch unstable is correct (repo default).

Lockfile changes are expected: ajv 8.17.1 → 8.18.0, transitive fast-uri 3.0.6 → 3.1.0, ajv 6.12.6 → 6.14.0.

1 prior finding(s) resolved.

---

@rtibblesbot's comments are generated by an LLM, and should be evaluated accordingly

How was this generated?

Compared the current PR state against findings from a prior review:

• Retrieved prior bot reviews deterministically via the GitHub API
• Classified each prior finding as RESOLVED, UNADDRESSED, ACKNOWLEDGED, or CONTESTED
• Only raised NEW findings for newly introduced code
• Reviewed the pull request diff checking for correctness, design, architecture, testing, completeness, and adherence to DRY/SRP principles
• Checked CI status and linked issue acceptance criteria

[rtibbles]

@dependabot rebase

[rtibbles]

@dependabot rebase

[rtibbles]

No concerns from changelog.