From d8ab70b1664021ccd5cc7fb5dd186582ee3475f8 Mon Sep 17 00:00:00 2001
From: Oliver Kieselbach <oliver.kieselbach@outlook.com>
Date: Wed, 23 Sep 2026 08:29:58 +0200
Subject: [PATCH] chore(rules): override fast-json-patch to 3.1.1 (Dependabot
 #103)

ajv-cli 5.0.0 is the latest release and still declares fast-json-patch ^2.0.0,
so neither Dependabot nor npm audit fix can move past CVE-2021-4279. An npm
override forces 3.1.1 into the lockfile; the 3.x API is backward compatible and
the validate command used in combine-rules.yml never touches the package.
Verified: npm ci from the lockfile plus all four ajv validate steps pass locally.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 rules/scripts/package-lock.json | 19 +++----------------
 rules/scripts/package.json      |  3 +++
 2 files changed, 6 insertions(+), 16 deletions(-)

diff --git a/rules/scripts/package-lock.json b/rules/scripts/package-lock.json
index 65a2823f..4aecc97e 100644
--- a/rules/scripts/package-lock.json
+++ b/rules/scripts/package-lock.json
@@ -129,22 +129,9 @@
       "license": "MIT"
     },
     "node_modules/fast-json-patch": {
-      "version": "2.2.1",
-      "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-2.2.1.tgz",
-      "integrity": "sha512-4j5uBaTnsYAV5ebkidvxiLUYOwjQ+JSFljeqfTxCrH9bDmlCQaOJFS84oDJ2rAXZq2yskmk3ORfoP9DCwqFNig==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "fast-deep-equal": "^2.0.1"
-      },
-      "engines": {
-        "node": ">= 0.4.0"
-      }
-    },
-    "node_modules/fast-json-patch/node_modules/fast-deep-equal": {
-      "version": "2.0.1",
-      "resolved": "https://registry.npmjs.org/fast-deep-equal/-/fast-deep-equal-2.0.1.tgz",
-      "integrity": "sha512-bCK/2Z4zLidyB4ReuIsvALH6w31YfAQDmXMqMx6FyfHqvBxtjC0eRumeSu4Bs3XtXwpyIywtSTrVT99BxY1f9w==",
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/fast-json-patch/-/fast-json-patch-3.1.1.tgz",
+      "integrity": "sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==",
       "dev": true,
       "license": "MIT"
     },
diff --git a/rules/scripts/package.json b/rules/scripts/package.json
index 5a95f09e..45c1c655 100644
--- a/rules/scripts/package.json
+++ b/rules/scripts/package.json
@@ -5,5 +5,8 @@
   "devDependencies": {
     "ajv-cli": "5.0.0",
     "ajv-formats": "3.0.1"
+  },
+  "overrides": {
+    "fast-json-patch": "3.1.1"
   }
 }