From d766e6e42794cc5f82173f59907faff633f81a01 Mon Sep 17 00:00:00 2001
From: Joost Farla <joost@qonduct.io>
Date: Tue, 14 Jul 2026 13:08:56 +0200
Subject: [PATCH] Pin @asyncapi/specs to 6.11.1 via overrides
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

@asyncapi/specs 6.11.2 and 6.11.2-alpha.1 (published 2026-07-14) contain
malware (asyncapi/spec-json-schemas#656). @stoplight/spectral-rulesets
declares ^6.8.0 on it, so any fresh resolution pulls the compromised
version while it remains tagged latest on npm. Pin the transitive
dependency to the last clean release — via pnpm.overrides for pnpm and a
top-level overrides field for npm/Bun — and bump the patch version.

Note: overrides only apply at the root of an install, so this protects
builds of this repo, not consumers of the published package; their
protection is npm removing the malicious versions.
---
 package.json   | 8 +++++++-
 pnpm-lock.yaml | 3 +++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/package.json b/package.json
index bc02393..c0cc11e 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@geonovum/standards-checker",
-  "version": "1.1.4",
+  "version": "1.1.5",
   "type": "module",
   "license": "EUPL-1.2",
   "description": "Standards checker engine with Spectral-based validation, React UI, CLI toolkit and shared Vite/ESLint/Prettier/TS configs",
@@ -142,10 +142,16 @@
     "vite": "^8.1.4"
   },
   "packageManager": "pnpm@10.33.0",
+  "overrides": {
+    "@asyncapi/specs": "6.11.1"
+  },
   "pnpm": {
     "onlyBuiltDependencies": [
       "esbuild"
     ],
+    "overrides": {
+      "@asyncapi/specs": "6.11.1"
+    },
     "peerDependencyRules": {
       "allowedVersions": {
         "eslint-plugin-react-hooks>eslint": ">=10"
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index f4b8280..c52dac5 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -4,6 +4,9 @@ settings:
   autoInstallPeers: true
   excludeLinksFromLockfile: false
 
+overrides:
+  '@asyncapi/specs': 6.11.1
+
 importers:
 
   .: