fix: security issue of simple-eval package is fixed by SB-rohitdesai · Pull Request #2886 · stoplightio/spectral

SB-rohitdesai · 2026-01-30T06:06:35Z

Fixes #[STOP-4199].

Checklist

Tests added / updated
Docs added / updated

Does this PR introduce a breaking change?

Yes
No

If indicated yes above, please describe the breaking change(s).

Remove this quote before creating the PR.

Screenshots

Screen.Recording.2026-02-10.at.12.31.07.PM.mov

If applicable, add screenshots or gifs to help demonstrate the changes. If not applicable, remove this screenshots section before creating the PR.

Additional context

Add any other context about the pull request here. Remove this section if there is no additional context.
Doc for ref :- https://smartbear.atlassian.net/wiki/spaces/Stoplight/pages/5964562454/Security+Fix+_eval+Replacement+with+expr-eval-fork

prafullaAtSB

Have we not written new test cases? Can u add the test case to test spectral rule?

prafullaAtSB

The fix Changes are good for next steps.

## [6.15.1](https://github.com/stoplightio/spectral/compare/@stoplight/spectral-cli-6.15.0...@stoplight/spectral-cli-6.15.1) (2026-04-13) ### Bug Fixes * **cli:** fix bug where output gets truncated when too long ([#2862](#2862)) ([0e6fd33](0e6fd33)) * **cli:** throw error if no file found to lint ([#2778](#2778)) ([3e20072](3e20072)) * **core:** fix security issue of simple-eval package ([#2886](#2886)) ([8120a76](8120a76)) * **core:** respect off severity in intermediate rulesets ([#2890](#2890)) ([5b99b99](5b99b99)) * **formatters:** Fix rendering of github actions documentationUrl ([#2895](#2895)) ([df27b06](df27b06)) * **formatters:** markdown formatter with invalid-ref crashes spectral ([#2905](#2905)) ([59728e4](59728e4)) * **functions:** export or function ([#2812](#2812)) ([03532a5](03532a5)) * **repo:** release step marking repo as save for git ([#2884](#2884)) ([87147a6](87147a6)) * **repo:** remove acceptance step on release ([#2882](#2882)) ([73496c6](73496c6)) * **ruleset-migrator:** fix ruleset migrator output when a rule name contains '/' ([#2859](#2859)) ([115d1d0](115d1d0)) * **rulesets:** use uri-reference for openIdConnectUrl ([#2796](#2796)) ([c57eb59](c57eb59)) ### Features * **core:** allow extending rulesets with aliases ([#2870](#2870)) ([8db9718](8db9718)) * **core:** further adjustments for extending rulesets with aliases ([#2939](#2939)) ([26144bc](26144bc)) * **repo:** circleci migration to GHA (OP-35885) ([#2867](#2867)) ([884f079](884f079)) * **repo:** npm release workflow as gha ([#2880](#2880)) ([0147d6e](0147d6e)) * **repo:** post develop merge workflow ([#2877](#2877)) ([9420713](9420713)) * **repo:** replace skypack usage with esm cdn ([#2940](#2940)) ([0d6a910](0d6a910))

# [1.22.0](https://github.com/stoplightio/spectral/compare/@stoplight/spectral-core-1.21.0...@stoplight/spectral-core-1.22.0) (2026-04-13) ### Bug Fixes * **cli:** fix bug where output gets truncated when too long ([#2862](#2862)) ([0e6fd33](0e6fd33)) * **cli:** throw error if no file found to lint ([#2778](#2778)) ([3e20072](3e20072)) * **core:** fix security issue of simple-eval package ([#2886](#2886)) ([8120a76](8120a76)) * **core:** respect off severity in intermediate rulesets ([#2890](#2890)) ([5b99b99](5b99b99)) * **formatters:** Fix rendering of github actions documentationUrl ([#2895](#2895)) ([df27b06](df27b06)) * **formatters:** markdown formatter with invalid-ref crashes spectral ([#2905](#2905)) ([59728e4](59728e4)) * **rulesets:** use uri-reference for openIdConnectUrl ([#2796](#2796)) ([c57eb59](c57eb59)) ### Features * **core:** further adjustments for extending rulesets with aliases ([#2939](#2939)) ([26144bc](26144bc)) * **repo:** replace skypack usage with esm cdn ([#2940](#2940)) ([0d6a910](0d6a910))

## [1.5.1](https://github.com/stoplightio/spectral/compare/@stoplight/spectral-formatters-1.5.0...@stoplight/spectral-formatters-1.5.1) (2026-04-13) ### Bug Fixes * **cli:** fix bug where output gets truncated when too long ([#2862](#2862)) ([0e6fd33](0e6fd33)) * **cli:** throw error if no file found to lint ([#2778](#2778)) ([3e20072](3e20072)) * **core:** fix security issue of simple-eval package ([#2886](#2886)) ([8120a76](8120a76)) * **core:** respect off severity in intermediate rulesets ([#2890](#2890)) ([5b99b99](5b99b99)) * **formatters:** Fix rendering of github actions documentationUrl ([#2895](#2895)) ([df27b06](df27b06)) * **formatters:** markdown formatter with invalid-ref crashes spectral ([#2905](#2905)) ([59728e4](59728e4)) * **functions:** export or function ([#2812](#2812)) ([03532a5](03532a5)) * **repo:** release step marking repo as save for git ([#2884](#2884)) ([87147a6](87147a6)) * **repo:** remove acceptance step on release ([#2882](#2882)) ([73496c6](73496c6)) * **ruleset-migrator:** fix ruleset migrator output when a rule name contains '/' ([#2859](#2859)) ([115d1d0](115d1d0)) * **rulesets:** use uri-reference for openIdConnectUrl ([#2796](#2796)) ([c57eb59](c57eb59)) ### Features * **core:** allow extending rulesets with aliases ([#2870](#2870)) ([8db9718](8db9718)) * **core:** further adjustments for extending rulesets with aliases ([#2939](#2939)) ([26144bc](26144bc)) * **repo:** circleci migration to GHA (OP-35885) ([#2867](#2867)) ([884f079](884f079)) * **repo:** npm release workflow as gha ([#2880](#2880)) ([0147d6e](0147d6e)) * **repo:** post develop merge workflow ([#2877](#2877)) ([9420713](9420713)) * **repo:** replace skypack usage with esm cdn ([#2940](#2940)) ([0d6a910](0d6a910))

# [1.12.0](https://github.com/stoplightio/spectral/compare/@stoplight/spectral-ruleset-migrator-1.11.3...@stoplight/spectral-ruleset-migrator-1.12.0) (2026-04-13) ### Bug Fixes * **cli:** fix bug where output gets truncated when too long ([#2862](#2862)) ([0e6fd33](0e6fd33)) * **cli:** throw error if no file found to lint ([#2778](#2778)) ([3e20072](3e20072)) * **core:** fix security issue of simple-eval package ([#2886](#2886)) ([8120a76](8120a76)) * **core:** respect off severity in intermediate rulesets ([#2890](#2890)) ([5b99b99](5b99b99)) * **formatters:** Fix rendering of github actions documentationUrl ([#2895](#2895)) ([df27b06](df27b06)) * **formatters:** markdown formatter with invalid-ref crashes spectral ([#2905](#2905)) ([59728e4](59728e4)) * **repo:** release step marking repo as save for git ([#2884](#2884)) ([87147a6](87147a6)) * **repo:** remove acceptance step on release ([#2882](#2882)) ([73496c6](73496c6)) * **rulesets:** use uri-reference for openIdConnectUrl ([#2796](#2796)) ([c57eb59](c57eb59)) ### Features * **core:** allow extending rulesets with aliases ([#2870](#2870)) ([8db9718](8db9718)) * **core:** further adjustments for extending rulesets with aliases ([#2939](#2939)) ([26144bc](26144bc)) * **repo:** circleci migration to GHA (OP-35885) ([#2867](#2867)) ([884f079](884f079)) * **repo:** npm release workflow as gha ([#2880](#2880)) ([0147d6e](0147d6e)) * **repo:** post develop merge workflow ([#2877](#2877)) ([9420713](9420713)) * **repo:** replace skypack usage with esm cdn ([#2940](#2940)) ([0d6a910](0d6a910))

## [1.22.1](https://github.com/stoplightio/spectral/compare/@stoplight/spectral-rulesets-1.22.0...@stoplight/spectral-rulesets-1.22.1) (2026-04-13) ### Bug Fixes * **cli:** fix bug where output gets truncated when too long ([#2862](#2862)) ([0e6fd33](0e6fd33)) * **cli:** throw error if no file found to lint ([#2778](#2778)) ([3e20072](3e20072)) * **core:** fix security issue of simple-eval package ([#2886](#2886)) ([8120a76](8120a76)) * **core:** respect off severity in intermediate rulesets ([#2890](#2890)) ([5b99b99](5b99b99)) * **formatters:** Fix rendering of github actions documentationUrl ([#2895](#2895)) ([df27b06](df27b06)) * **formatters:** markdown formatter with invalid-ref crashes spectral ([#2905](#2905)) ([59728e4](59728e4)) * **functions:** export or function ([#2812](#2812)) ([03532a5](03532a5)) * **repo:** release step marking repo as save for git ([#2884](#2884)) ([87147a6](87147a6)) * **repo:** remove acceptance step on release ([#2882](#2882)) ([73496c6](73496c6)) * **ruleset-migrator:** fix ruleset migrator output when a rule name contains '/' ([#2859](#2859)) ([115d1d0](115d1d0)) * **rulesets:** use uri-reference for openIdConnectUrl ([#2796](#2796)) ([c57eb59](c57eb59)) ### Features * **core:** allow extending rulesets with aliases ([#2870](#2870)) ([8db9718](8db9718)) * **core:** further adjustments for extending rulesets with aliases ([#2939](#2939)) ([26144bc](26144bc)) * **repo:** circleci migration to GHA (OP-35885) ([#2867](#2867)) ([884f079](884f079)) * **repo:** npm release workflow as gha ([#2880](#2880)) ([0147d6e](0147d6e)) * **repo:** post develop merge workflow ([#2877](#2877)) ([9420713](9420713)) * **repo:** replace skypack usage with esm cdn ([#2940](#2940)) ([0d6a910](0d6a910))

stoplight-bot · 2026-04-13T12:57:21Z

🎉 This PR is included in version 1.22.0 🎉

The release is available on @stoplight/spectral-core-1.22.0

Your semantic-release bot 📦🚀

## [1.1.5](https://github.com/stoplightio/spectral/compare/@stoplight/spectral-runtime-1.1.4...@stoplight/spectral-runtime-1.1.5) (2026-04-14) ### Bug Fixes * **cli:** fix bug where output gets truncated when too long ([#2862](#2862)) ([0e6fd33](0e6fd33)) * **cli:** throw error if no file found to lint ([#2778](#2778)) ([3e20072](3e20072)) * **core:** fix security issue of simple-eval package ([#2886](#2886)) ([8120a76](8120a76)) * **core:** respect off severity in intermediate rulesets ([#2890](#2890)) ([5b99b99](5b99b99)) * **deps:** bump elliptic from 6.6.0 to 6.6.1 ([#2782](#2782)) ([5ff9602](5ff9602)) * **deps:** fix yarn lockfile ([e6c3b9d](e6c3b9d)) * **deps:** post lodash update changes for semantic release ([#2942](#2942)) ([bf530dd](bf530dd)) * **deps:** update spectral-core in cli ([35687cd](35687cd)) * **formatters:** Fix rendering of github actions documentationUrl ([#2895](#2895)) ([df27b06](df27b06)) * **formatters:** markdown formatter with invalid-ref crashes spectral ([#2905](#2905)) ([59728e4](59728e4)) * **functions:** export or function ([#2812](#2812)) ([03532a5](03532a5)) * **repo:** release step marking repo as save for git ([#2884](#2884)) ([87147a6](87147a6)) * **repo:** remove acceptance step on release ([#2882](#2882)) ([73496c6](73496c6)) * **repo:** replace discord link with forum link ([#2793](#2793)) ([6229442](6229442)) * **ruleset-migrator:** fix ruleset migrator output when a rule name contains '/' ([#2859](#2859)) ([115d1d0](115d1d0)) * **rulesets:** use uri-reference for openIdConnectUrl ([#2796](#2796)) ([c57eb59](c57eb59)) ### Features * **core:** add documentUrl to JS api and cli formatters ([#2443](#2443)) ([e787728](e787728)) * **core:** allow extending rulesets with aliases ([#2870](#2870)) ([8db9718](8db9718)) * **core:** further adjustments for extending rulesets with aliases ([#2939](#2939)) ([26144bc](26144bc)) * **functions:** add or function ([#2798](#2798)) ([d9ef27f](d9ef27f)) * **repo:** circleci migration to GHA (OP-35885) ([#2867](#2867)) ([884f079](884f079)) * **repo:** npm release workflow as gha ([#2880](#2880)) ([0147d6e](0147d6e)) * **repo:** post develop merge workflow ([#2877](#2877)) ([9420713](9420713)) * **repo:** replace skypack usage with esm cdn ([#2940](#2940)) ([0d6a910](0d6a910))

fix: issue of simple-eval security issue is fixed

ab288ff

SB-rohitdesai requested a review from a team as a code owner January 30, 2026 06:06

SB-rohitdesai changed the title ~~fix: issue of simple-eval security issue is fixed~~ fix: security issue of simple-eval package is fixed Jan 30, 2026

SB-rohitdesai requested review from bhaskarsontakke and prafullaAtSB January 30, 2026 06:17

prafullaAtSB reviewed Jan 31, 2026

View reviewed changes

MichakrawSB and others added 3 commits February 2, 2026 11:57

Merge branch 'develop' into fix/stop-4199

48bd8c9

Merge branch 'develop' into fix/stop-4199

dd29adb

fix(core): changes for block fs operations

87f5ef2

SB-rohitdesai requested a review from prafullaAtSB February 10, 2026 07:17

SB-rohitdesai added 5 commits February 11, 2026 15:16

fix(core): testcase added for print function

ebb8680

fix(core): failing test cases fixed

c4155d0

fix(core): failed test cases fixed

c1fcb06

fix(core): test-browser issue is fixed

86ff2b0

fix(core): test-browser issue is fixed

5f7f07d

prafullaAtSB approved these changes Feb 11, 2026

View reviewed changes

tomek-tursa-sb approved these changes Feb 12, 2026

View reviewed changes

tomek-tursa-sb merged commit 8120a76 into develop Feb 12, 2026
8 checks passed

tomek-tursa-sb deleted the fix/stop-4199 branch February 12, 2026 17:33

stoplight-bot added the released label Apr 13, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: security issue of simple-eval package is fixed#2886

fix: security issue of simple-eval package is fixed#2886
tomek-tursa-sb merged 9 commits into
developfrom
fix/stop-4199

SB-rohitdesai commented Jan 30, 2026 •

edited

Loading

Uh oh!

prafullaAtSB left a comment

Uh oh!

prafullaAtSB left a comment

Uh oh!

Uh oh!

stoplight-bot commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Uh oh!

Conversation

SB-rohitdesai commented Jan 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

prafullaAtSB left a comment

Choose a reason for hiding this comment

Uh oh!

prafullaAtSB left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

stoplight-bot commented Apr 13, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

SB-rohitdesai commented Jan 30, 2026 •

edited

Loading