npm audit reported 6 vulnerabilities (1 moderate, 5 high) in transitive and direct dependencies.

Changes

• Replace jsonpath → jsonpath-plus: jsonpath has an unfixed arbitrary code injection vulnerability (via unsafe eval). Swapped to jsonpath-plus@^10.4.0, updating the call site in scripts/osrm-runner.js:

  // before
  jp.query(json, filter)
  // after
  JSONPath({path: filter, json: json})

• Add ajv override (>=6.14.0): Forces patched version for transitive deps affected by a ReDoS in ajv < 6.14.0.

• Add minimatch override (>=10.2.1): Forces patched version through the faucet → tape → dotignore → minimatch chain, which pinned a vulnerable minimatch < 10.2.1.

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.