Skip to content

Update dependency orval to v8.22.0 [SECURITY] - #431

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-orval-vulnerability
Open

Update dependency orval to v8.22.0 [SECURITY]#431
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-orval-vulnerability

Conversation

@renovate

@renovate renovate Bot commented Sep 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
orval (source) 8.5.3 → 8.22.0 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Orval: Import-time RCE via query-parameter default -> zod module-level template literal

CVE-2026-72716 / GHSA-p4cg-3328-rvfg

More information

Details

Summary

Orval's zod schema generation emits the query-parameter default value as a module-level template literal
(export const …Default = ;) without escaping ${ or the backtick. A default of the form
v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is
imported, executing attacker-controlled code at import — no request or function call needed. Verified
on Orval 8.19.0; survives default OpenAPI validation.

Details
export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: a query parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod
template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose
to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles
it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an
attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${
if a template literal must be used); never interpolate a spec value into a template literal. Apply to
every default position.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client

CVE-2026-71866 / GHSA-6mr6-jvcr-2f25

More information

Details

Summary

orval's zod client emits each schema property name as a double-quoted key in the generated zod.object({...})
WITHOUT escaping the double quote. A " in a property name closes the key and lands in object-literal
context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- which
is at MODULE IMPORT (the export const X = zod.object({...}) executes on load) -> import-time RCE. The
property name is a pure data field. Verified on orval 8.19.0 / Node. CWE-94 / CWE-95 / CWE-116.

Details
export const OpBody = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": zod.string().optional() })

Sibling: the MSW mock uses a single-quoted key (' breakout, call-time) -- separate report. The TS interface
key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a property name a":zod.string(),[require("fs").writeFileSync("","")]:zod.string(),"b
-> zod.object; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution (via child_process) at import time for anyone who generates an orval zod
client from an attacker-controlled spec and imports it. Estimated Critical, e.g.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N.

Suggested fix

Escape the property name for the JS string key (JSON.stringify) in the zod.object key generation; never
interpolate a raw property name adjacent to [ ] in object-literal position.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref

CVE-2026-62680 / GHSA-cxq5-97v7-87j8

More information

Details

Summary

Orval resolves OpenAPI $refs by fetching remote http(s) URLs and reading local files (including
absolute / out-of-tree paths), inlining the referenced schema into the generated client. Running
orval on a spec whose $ref points at an attacker/internal URL or an arbitrary local file yields
SSRF, remote file inclusion, and local file inclusion. Verified on 8.19.0. This is a different class
from Orval's published output-injection CVEs (CVE-2026-22785/23947/24132/25141), none of which covers
the $ref resolver.

Details
  • $ref: http://attacker/internal-evil.json#/... → build host fetches (SSRF) and inlines the remote
    schema (RFI); confirmed property REMOTE_ORVAL_PROP in the generated client.
  • $ref: /abs/path.json#/... or ../../secret.json#/... → out-of-tree local file read + inlined (LFI).

No RCE: on 8.19.0 the description JSDoc is escaped (*/->*\/, the published fix), so $ref content
cannot break out into code. The chain stops at SSRF + RFI + LFI.

Fix: don't resolve remote $refs by default (opt-in + host allowlist); confine local $ref
resolution to the input directory tree (reject absolute paths and ../ escapes).

PoC

reproduce.sh attached: confirms LFI (out-of-tree read), SSRF (listener hit), RFI (remote schema
inlined). Verified on Orval 8.19.0.

Impact

Build-time SSRF from the developer or CI host, disclosure of arbitrary local files, and inclusion of untrusted remote content, from running the generator on an attacker-controlled or attacker-influenced OpenAPI description. No code execution (output escaping is in place post the earlier fixes).

Severity

  • CVSS Score: 7.1 / 10 (High)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client

CVE-2026-71864 / GHSA-6437-gxhq-pqv8

More information

Details

Summary

orval's zod client emits each header parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the header parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpHeader = zod.object({...}) executes on load) -> import-time RCE. The header parameter name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const OpHeader = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... })

Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, query parameter name (CVE-96) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a header parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.

Suggested fix

Escape the header parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to [ ] in object-literal position.

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli

CVE-2026-71865 / GHSA-653q-5476-x79g

More information

Details

Summary

orval's zod client emits each query parameter name as a double-quoted key in the generated zod.object({...}) request-validation schema WITHOUT escaping the double quote. A " in the query parameter name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when zod.object({...}) runs -- at MODULE IMPORT (export const OpQueryParams = zod.object({...}) executes on load) -> import-time RCE. The query parameter name is a pure data field. Verified on orval 8.19.0 / Node.

Details

export const OpQueryParams = zod.object({ "a":zod.string(),[require("fs").writeFileSync("PWNED","")]:zod.string(),"b": ... })

Also affects the hono client (reuses zod generation). orval escapes values in zod arrays but not keys in zod.object. Sibling fields: schema property name, header parameter name (CVE-97) (separate reports). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a query parameter name that breaks the zod.object key and injects a computed key; evaluating it (= importing the module) writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution at import time for anyone who generates an orval zod client from an attacker-controlled spec and imports it.

Suggested fix

Escape the query parameter name for the JS string key (JSON.stringify) in the zod.object key generation; never interpolate a raw name adjacent to [ ] in object-literal position. maintainer-report.txt make_spec.py reproduce.sh

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Import-time RCE via enum-typed default -> zod module-level template literal

CVE-2026-71868 / GHSA-3575-w9fc-c2j6

More information

Details

Summary

Orval's zod schema generation emits the enum-typed default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details
export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: an enum-typed property with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position.

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator

CVE-2026-71867 / GHSA-2w86-xfrc-g85r

More information

Details

Summary

orval, when generating MSW mocks (output.mock: true), emits each schema property name as a single-quoted object key in the mock factory WITHOUT escaping the single quote. A ' in a property name closes the key and lands in object-literal context, where an injected computed property key [expr] is evaluated when the mock factory is called (e.g. in tests / MSW handlers) -> RCE. The property name is a pure data field. Verified on orval 8.19.0 / Node.

Details
export const getOpResponseMock = (...): Thing => ({'x': 0, [require("fs").writeFileSync("PWNED","")]: 0, 'y': faker...., ...overrideResponse});

Safe elsewhere: the zod schema double-quotes the property name; the TS interface key is a type (DoS only). Distinct from orval's $ref / route-path / server-url / zod-default findings.

PoC

reproduce.sh (+ make_spec.py) attached: a property name x': 0, [require("fs").writeFileSync("<marker>","")]: 0, 'y -> mock object literal; calling the mock factory writes the marker. Verified on 8.19.0.

Impact

JavaScript / OS command execution (via child_process) on the machine of anyone who generates orval mocks from an attacker controlled spec and runs them (tests / MSW).

Suggested fix

Escape the property name for the JS string key (JSON.stringify), and never interpolate a raw property name adjacent to [ ] in object-literal position.

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Import-time RCE via header-parameter default -> zod module-level template literal

CVE-2026-71871 / GHSA-8j6p-r8jg-mxqh

More information

Details

Summary

Orval's zod schema generation emits the header-parameter default value as a module-level template literal (export const Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details
export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: a header parameter with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. make_spec.py reproduce.sh

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Import-time RCE via array-items default -> zod module-level template literal

CVE-2026-71869 / GHSA-2h9g-j24r-h63g

More information

Details

Summary

Orval's zod schema generation emits the array-items default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details
export const …Default = `v${globalThis.ORVPWN()}w`;   // ${...} = arbitrary JS expression, runs at import

Malicious input: an array property (string items) with a default of v${<attacker JS>}w. ${...} permits any JS expression.

Note: this is one of several default-bearing positions that reach the same unescaped zod template-literal sink; a single fix (escape default values) closes all of them, and a CNA may choose to consolidate the related reports.

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal. Apply to every default position. maintainer-report.txt make_spec.pyreproduce.sh

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: Import-time RCE via schema default -> zod module-level template literal

CVE-2026-72717 / GHSA-w727-8j6c-2rj4

More information

Details

Summary

Orval's zod schema generation emits a schema's default value as a module-level template literal (export const …Default = ;) without escaping ${ or the backtick. A default of the form v${<code>}w injects a live JavaScript expression that is evaluated when the generated zod schema module is imported, executing attacker-controlled code at import — no request or function call needed. Verified on Orval 8.19.0; survives default OpenAPI validation.

Details
export const getIResponseDsDefault = `v${globalThis.ORVPWN()}w`;

${...} permits an arbitrary JS expression. Orval escapes its other value sinks (enum, mock, regex, object-default values) with \' inside single-quoted strings; the string default is the one value emitted as a backtick template literal, so ${...}/backtick are interpreted, not escaped. Distinct from the URL-template-literal cases (different field and sink) and from the published Orval CVEs (summary/MCP, x-enumDescriptions, const/mock).

PoC

reproduce.sh (+ make_spec.py) attached: generates the zod schema with default validation, bundles it, imports it, and shows a marker written at import. Verified on 8.19.0.

Impact

Code execution at import in any application that imports a zod schema module generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Emit default values via a proper string-literal encoder (JSON.stringify, or escape backtick and ${ if a template literal must be used); never interpolate a spec value into a template literal.

maintainer-report.txt
make_spec.py
reproduce.sh

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)

CVE-2026-62682 / GHSA-88f2-fpv8-89q2

More information

Details

Summary

When Orval is configured with output.baseUrl.getBaseUrlFromSpecification: true, it bakes the spec's servers[0].url into the generated request URL as a template literal without escaping the backtick. A server URL containing a backtick closes the template literal and injects a concatenation expression evaluated when the generated URL/request function is called, executing attacker-controlled code. Verified on Orval 8.19.0 (fetch client); survives default OpenAPI validation.

Details
return `http://api.x/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/v1/u`;

Prerequisite: the documented getBaseUrlFromSpecification: true option (takes the base URL from the OpenAPI servers block). This is the same output sink as the route-path case (request-URL template literal) reached via the server url field. Distinct from Orval's published CVEs (CVE-2026-22785 summary/MCP, CVE-2026-23947 / CVE-2026-25141 x-enumDescriptions, CVE-2026-24132 const/mock).

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with getBaseUrlFromSpecification: true, bundles it, calls the functions, and shows a marker written. Verified on 8.19.0.

Impact

With that option enabled, code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description.

Suggested fix

Escape the server URL before emitting it into the URL template literal (escape backtick and ${), or build the base URL with an encoder that treats it as data; validate the URL.
maintainer-report.txt
make_spec.py
reproduce.sh

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)

CVE-2026-62681 / GHSA-fg9p-mrxr-hvq7

More information

Details

Summary

Orval emits the OpenAPI path into the generated request URL as a TEMPLATE LITERAL (`/users/...`) without escaping the backtick character. A path containing a backtick closes the template literal and injects a concatenation expression that is evaluated when the generated URL/request/key function is called, executing attacker-controlled code. Affects the axios, fetch, react-query, and swr clients. Verified on Orval 8.19.0; survives Orval's default OpenAPI validation.

Details
// generated URL builder (fetch client)
return `/users/` + (globalThis.X = require("fs").writeFileSync("/marker","pwned")) + `/list`;

The backtick in the path terminates the `...` literal; + (<code>) + runs as a live expression; a trailing backtick reopens a template literal so the file stays valid. The code runs whenever the generated request function, URL builder, or query-key function is called.

This is distinct from Orval's four published CVEs: CVE-2026-22785 (summary -> MCP server), CVE-2026-23947 / CVE-2026-25141 (x-enumDescriptions), and CVE-2026-24132 (const -> mock files). This is a different field (the route path) and a different sink (the request-URL template literal), which those advisories and their fixes do not cover.

PoC

reproduce.sh (+ make_spec.py) attached: generates a fetch client with default validation, bundles it, calls the generated functions, and shows a marker file written. Verified on 8.19.0.

Impact

Code execution in any environment that calls a client generated from an attacker-controlled or attacker-influenced OpenAPI description (developer, CI, or the running application).

Suggested fix

Escape the path before emitting it into the URL template literal (escape backtick and ${, or build the URL with an encoder that treats the path as data), and validate path characters.

Severity

  • CVSS Score: 9.3 / 10 (Critical)
  • Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

orval-labs/orval (orval)

v8.22.0

Compare Source

What's Changed

[!IMPORTANT]
Security Fix is a breaking change that now requires you to configure if you want refs to be external and not traverse directories etc. Please see the docs for how to use and override: https://orval.dev/docs/reference/configuration/input#externalrefs

Full Changelog: orval-labs/orval@v8.21.0...v8.22.0

v8.21.0

Compare Source

What's Changed

New Contributors

Full Changelog: orval-labs/orval@v8.20.0...v8.21.0

v8.20.0

Compare Source

What's Changed

New Contributors

Full Changelog: orval-labs/orval@v8.19.0...v8.20.0

v8.19.0

Compare Source

What's Changed

[!NOTE]
Zod v4 is now the default but you can change it to be v3 with a config change

New Contributors

Full Changelog: orval-labs/orval@v8.18.0...v8.19.0

v8.18.0

Compare Source

What's Changed

  • fix(core): generate requiredNullableParamKeys only if preserveRequire… by @​jjfreez in #​3597
  • fix(zod): resolve global zod mutators against output workspace by @​chippleh1392 in #​3598
  • fix(mcp): order handler body/query args and propagate optional body to handler + tool schema by @​yagop in #​3600
  • fix(query): resolve global query mutators against output workspace by @​chippleh1392 in #​3604
  • fix(query): attach queryKey without spreading the react-query result by @​wadakatu in #​3605
  • fix(core): use getImportExtension for NodeNext module resolution across all writers by @​aqeelat in #​3603
  • feat(zod): coerce single-value array query params via opt-in coerce: ['array'] by @​NathanFichefet in #​3609
  • fix(core): escape

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/npm-orval-vulnerability branch from bd9e04a to 2328bc4 Compare September 13, 2026 19:36
@renovate
renovate Bot force-pushed the renovate/npm-orval-vulnerability branch from 2328bc4 to 73bfcd7 Compare September 19, 2026 15:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants