chore(deps): update jsonpath-plus to a safe version

[sloanesturz]

Fixes #2779.

Checklist

• Tests added / updated
• Docs added / updated

Does this PR introduce a breaking change?

• Yes
• No

If indicated yes above, please describe the breaking change(s).

Remove this quote before creating the PR.

Screenshots

Not applicable.

Additional context

As described in the issue, #2779, jsonpath-plus v10.2.0 has a vulnerability to remote code execution. This pulls in the next minor version, which is patched.

The changes between the versions are here, and seem straightforward: JSONPath-Plus/JSONPath@v10.2.0...v10.3.0

[Beretta1979]

you need to update your commit message... something like
chore(deps): update jsonpath-plus to a safe version
should be accepted

[mriedem]

Functionally this looks good to me, but need to update the commit message as noted.

[sloanesturz]

Thank you all for your help!

@Beretta1979 @mriedem once you approve it from your end, can you publish a new version, too?

[Beretta1979]

Thank you all for your help!

@Beretta1979 @mriedem once you approve it from your end, can you publish a new version, too?

I'm not a maintainer :)

[mriedem]

I'm not a maintainer :)

same

[kkempsky]

Was it published? I mean, how to bump version to not have this problem?

[mriedem]

Was it published? I mean, how to bump version to not have this problem?

Not yet. @mnaumanali94 is this something you're able to release?

[k0ka]

It is still not published.
https://www.npmjs.com/package/@stoplight/spectral-core/v/1.19.4?activeTab=code
shows old 10.2.0 version. I guess we have to increase the version in the package.json for npmjs to fetch new version.