chore(deps): bump ajv from 6.12.6 to 6.14.0

[dependabot]

Bumps ajv from 6.12.6 to 6.14.0.

Commits

• e3af0a7 6.14.0
• b552ed6 add regExp option to address $data exploit via a regular expression (CVE-2025...
• 72f2286 docs: update v7 info
• 231e52b Merge pull request #1320 from philsturgeon/patch-1
• d3475fc Add spectral, an AJV util from a sponsor
• 413afe0 docs: v7.0.0-beta.3
• 11e997b update readme for v7
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[rpl]

@dependabot rebase

[rpl]

@willdurand and I agreed that we prefer to update the ajv transitive dependency on the addons-linter side (where it is actually a direct dependency) and let web-ext inherit the ajv dependency update through the next addons-linter version bump.

[willdurand]

@dependabot rebase

[rpl]

Turned out that ajv v6 is a transitive dependency that we are inheriting separately through eslint (whereas the addons-linter depends from ajv v8) and so it looks we will need also this PR to apply the fix to the web-ext package lock.

$ npm ls ajv
web-ext@9.3.0 /Users/rpl/my/mozlab/github-projects/web-ext--vanilla
├─┬ @commitlint/cli@20.4.2
│ └─┬ @commitlint/load@20.4.0
│   └─┬ @commitlint/config-validator@20.4.0
│     └── ajv@8.18.0 deduped
├─┬ @eslint/eslintrc@3.3.3
│ └── ajv@6.12.6
├─┬ addons-linter@9.9.0
│ ├── ajv@8.18.0
│ └─┬ eslint@9.39.2
│   └── ajv@6.12.6
└─┬ eslint@9.39.0
  └── ajv@6.12.6

[willdurand]

@dependabot rebase

[willdurand]

❯ npm ls ajv
web-ext@9.3.0 /Users/wdurand/projects/mozilla/web-ext
├─┬ @commitlint/cli@20.4.2
│ └─┬ @commitlint/load@20.4.0
│   └─┬ @commitlint/config-validator@20.4.0
│     └── ajv@8.18.0 deduped
├─┬ @eslint/eslintrc@3.3.3
│ └── ajv@6.12.6
├─┬ addons-linter@9.9.1
│ ├── ajv@8.18.0
│ └─┬ eslint@9.39.2
│   └── ajv@6.12.6
└─┬ eslint@9.39.0
  └── ajv@6.12.6