security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-2g4f-4pwh-qvx6	ajv, eslint	None	9.39.1	6.14.0		confirmed

Not Included

• Deferred by batch limit: 6 advisories. They will be considered by future runs.
• Other deferred scanner findings: 2.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	commander	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	highlight.js	Non-CVE alert is not handled by dependency remediation.

---

Note

Low Risk
Lockfile-only patch bump of a dev-time JSON Schema validator used by ESLint, with no runtime or auth/data-path changes.

Overview
Addresses GHSA-2g4f-4pwh-qvx6 by updating the resolved ajv version in yarn.lock from 6.12.6 to 6.14.0 for the existing ajv@^6.12.4 range (pulled in by ESLint / @eslint/eslintrc).

There are no package.json or application code changes—only the lockfile entry and integrity hash for that dependency.

^{Reviewed by Cursor Bugbot for commit 612679f. Bugbot is set up for automated code reviews on this repo. Configure here.}

[firetiger-agent]

Created a monitoring plan for this PR.

What this PR does: Removes a known vulnerable build-time dependency (ajv 6.12.6) from the Node SDK's dev toolchain by upgrading it to 6.14.0. This does not affect the published @onkernel/sdk package that developers install — ajv is only used internally by ESLint during CI.

Intended effect:

• GHSA-2g4f-4pwh-qvx6 remediated: yarn.lock resolves ajv@^6.12.4 to 6.14.0 (was 6.12.6); confirmed when yarn.lock entry shows the new hash post-merge
• CI lint/build/test: baseline = all three jobs pass on main; confirmed if all three jobs pass on this commit (no ESLint/schema validation regressions)

Risks:

• ESLint schema incompatibility — ajv minor bump within 6.x is low-risk but eslint plugins could break; alert if the CI lint job fails with an ajv-related error on commit 7c3b0bc
• Unintended publish — ajv is dev-only; the published npm artifact should be unchanged; alert if publish-npm.yml is triggered unexpectedly as part of this PR merge

View monitor