Vulnerable transitive dependency (ajv) in @pnp/spfx-property-controls v3.23.0

[shirishmawande]

Category

• Enhancement

Version

3.23.0

Issue Description

While upgrading SPFx solution to 1.23.0, I observed that the latest @pnp/spfx-property-controls (v3.23.0) resolves the following vulnerable transitive dependency:

• ajv (currently resolves to vulnerable version 8.13.0)

As a workaround, consumers currently need to maintain package manager overrides to use a non-vulnerable version.

Here is Snyk Screenshot:

Expected / Desired Behavior

Please consider updating the vulnerable transitive dependency to the latest compatible non-vulnerable version, for example:

• ajv → 8.20.0

Updating this dependency would eliminate the need for consumers to maintain manual dependency overrides and improve security compliance for solutions using @pnp/spfx-property-controls.

Steps to Reproduce

1. Install the latest @pnp/spfx-property-controls (v3.23.0).
2. Run a dependency vulnerability scan (for example, Snyk, pnpm audit, or GitHub Dependabot).
3. Observe that ajv (8.13.0) is reported as a vulnerable transitive dependency