@apidevtools/json-schema-ref-parser 15.3.4 → 15.3.6

package/README.md

@@ -15,7 +15,7 @@ Install using [npm](https://docs.npmjs.com/about-npm/):
 
 ```bash
 npm install @apidevtools/json-schema-ref-parser
-yarn add @apidevtools/json-schema-ref-parser
+pnpm add @apidevtools/json-schema-ref-parser
 bun add @apidevtools/json-schema-ref-parser
 ```
 
@@ -142,10 +142,10 @@ To build/test the project locally on your computer:
    `git clone https://github.com/APIDevTools/json-schema-ref-parser.git`
 
 2. **Install dependencies**<br>
-   `yarn install`
+   `pnpm install`
 
 3. **Run the tests**<br>
-   `yarn test`
+   `pnpm test`
 
 ## License
 

package/dist/lib/bundle.js

@@ -12,9 +12,12 @@ import { getSchemaBasePath } from "./util/schema-resources.js";
  */
 function bundle(parser, options) {
     // console.log('Bundling $ref pointers in %s', parser.$refs._root$Ref.path);
+    const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+        ? getSchemaBasePath(parser.$refs._root$Ref.path, parser.schema)
+        : parser.$refs._root$Ref.path;
     // Build an inventory of all $ref pointers in the JSON Schema
     const inventory = [];
-    crawl(parser, "schema", parser.$refs._root$Ref.path + "#", parser.$refs._root$Ref.path, parser.$refs._root$Ref.dynamicIdScope, "#", 0, inventory, parser.$refs, options);
+    crawl(parser, "schema", parser.$refs._root$Ref.path + "#", rootScopeBase, parser.$refs._root$Ref.dynamicIdScope, "#", 0, inventory, parser.$refs, options);
     // Get the root schema's $id (if any) for qualifying refs inside sub-schemas with their own $id
     const rootId = parser.schema && typeof parser.schema === "object" && "$id" in parser.schema
         ? parser.schema.$id
@@ -44,7 +47,7 @@ function crawl(parent, key, path, scopeBase, dynamicIdScope, pathFromRoot, indir
     const bundleOptions = (options.bundle || {});
     const isExcludedPath = bundleOptions.excludedPathMatcher || (() => false);
     if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
-        const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+        const currentScopeBase = scopeBase;
         if ($Ref.isAllowed$Ref(obj)) {
             inventory$Ref(parent, key, path, currentScopeBase, dynamicIdScope, pathFromRoot, indirections, inventory, $refs, options);
         }
@@ -71,12 +74,14 @@ function crawl(parent, key, path, scopeBase, dynamicIdScope, pathFromRoot, indir
                 const keyPath = Pointer.join(path, key);
                 const keyPathFromRoot = Pointer.join(pathFromRoot, key);
                 const value = obj[key];
+                const childScopeBase = dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+                    ? getSchemaBasePath(currentScopeBase, value)
+                    : currentScopeBase;
                 if ($Ref.isAllowed$Ref(value)) {
-                    const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
-                    inventory$Ref(obj, key, keyPath, valueScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
+                    inventory$Ref(obj, key, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
                 }
                 else {
-                    crawl(obj, key, keyPath, currentScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
+                    crawl(obj, key, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
                 }
                 // We need to ensure that we have an object to work with here because we may be crawling
                 // an `examples` schema and `value` may be nullish.

package/dist/lib/dereference.js

@@ -13,8 +13,11 @@ export default dereference;
  */
 function dereference(parser, options) {
     const start = Date.now();
+    const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+        ? getSchemaBasePath(parser.$refs._root$Ref.path, parser.schema)
+        : parser.$refs._root$Ref.path;
     // console.log('Dereferencing $ref pointers in %s', parser.$refs._root$Ref.path);
-    const dereferenced = crawl(parser.schema, parser.$refs._root$Ref.path, parser.$refs._root$Ref.path, parser.$refs._root$Ref.dynamicIdScope, "#", new Set(), new Set(), new Map(), parser.$refs, options, start, 0);
+    const dereferenced = crawl(parser.schema, parser.$refs._root$Ref.path, rootScopeBase, parser.$refs._root$Ref.dynamicIdScope, "#", new Set(), new Set(), new Map(), parser.$refs, options, start, 0);
     parser.$refs.circular = dereferenced.circular;
     parser.schema = dereferenced.value;
 }
@@ -52,7 +55,7 @@ function crawl(obj, path, scopeBase, dynamicIdScope, pathFromRoot, parents, proc
         if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
             parents.add(obj);
             processedObjects.add(obj);
-            const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+            const currentScopeBase = scopeBase;
             if ($Ref.isAllowed$Ref(obj, options)) {
                 dereferenced = dereference$Ref(obj, path, currentScopeBase, dynamicIdScope, pathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth);
                 result.circular = dereferenced.circular;
@@ -67,10 +70,12 @@ function crawl(obj, path, scopeBase, dynamicIdScope, pathFromRoot, parents, proc
                         continue;
                     }
                     const value = obj[key];
+                    const childScopeBase = dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+                        ? getSchemaBasePath(currentScopeBase, value)
+                        : currentScopeBase;
                     let circular;
                     if ($Ref.isAllowed$Ref(value, options)) {
-                        const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
-                        dereferenced = dereference$Ref(value, keyPath, valueScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth);
+                        dereferenced = dereference$Ref(value, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth);
                         circular = dereferenced.circular;
                         // Avoid pointless mutations; breaks frozen objects to no profit
                         if (obj[key] !== dereferenced.value) {
@@ -107,7 +112,7 @@ function crawl(obj, path, scopeBase, dynamicIdScope, pathFromRoot, parents, proc
                     }
                     else {
                         if (!parents.has(value)) {
-                            dereferenced = crawl(value, keyPath, currentScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth + 1);
+                            dereferenced = crawl(value, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, parents, processedObjects, dereferencedCache, $refs, options, startTime, depth + 1);
                             circular = dereferenced.circular;
                             // Avoid pointless mutations; breaks frozen objects to no profit
                             if (obj[key] !== dereferenced.value) {

package/dist/lib/pointer.js

@@ -7,6 +7,7 @@ const slashes = /\//g;
 const tildes = /~/g;
 const escapedSlash = /~1/g;
 const escapedTilde = /~0/g;
+const unsafeSetTokens = new Set(["__proto__", "constructor", "prototype"]);
 /**
  * This class represents a single JSON pointer and its resolved value.
  *
@@ -74,7 +75,7 @@ class Pointer {
         const found = [];
         // Crawl the object, one token at a time
         this.value = unwrapOrThrow(obj);
-        if (this.$ref.dynamicIdScope) {
+        if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
             this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
         }
         for (let i = 0; i < tokens.length; i++) {
@@ -161,9 +162,10 @@ class Pointer {
             this.value = value;
             return value;
         }
+        assertSafeSetTokens(this.path, tokens);
         // Crawl the object, one token at a time
         this.value = unwrapOrThrow(obj);
-        if (this.$ref.dynamicIdScope) {
+        if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
             this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
         }
         for (let i = 0; i < tokens.length - 1; i++) {
@@ -273,9 +275,6 @@ function resolveIf$Ref(pointer, options, pathFromRoot) {
                 // This JSON reference "extends" the resolved value, rather than simply pointing to it.
                 // So the resolved path does NOT change.  Just the value does.
                 pointer.value = $Ref.dereference(pointer.value, resolved.value, options);
-                if (pointer.$ref.dynamicIdScope) {
-                    pointer.scopeBase = getSchemaBasePath(pointer.scopeBase, pointer.value);
-                }
                 return false;
             }
             else {
@@ -283,9 +282,10 @@ function resolveIf$Ref(pointer, options, pathFromRoot) {
                 pointer.$ref = resolved.$ref;
                 pointer.path = resolved.path;
                 pointer.value = resolved.value;
-                pointer.scopeBase = pointer.$ref.dynamicIdScope
-                    ? getSchemaBasePath(pointer.$ref.path, pointer.value)
-                    : pointer.$ref.path;
+                // `pointer.$ref.path` is already the canonical location of the resolved resource.
+                // Re-applying the resource's own `$id` here would duplicate nested path segments
+                // such as `nested/nested/foo.json`.
+                pointer.scopeBase = pointer.$ref.path;
             }
             return true;
         }
@@ -318,6 +318,13 @@ function setValue(pointer, token, value) {
     }
     return value;
 }
+function assertSafeSetTokens(pointerPath, tokens) {
+    for (const token of tokens) {
+        if (unsafeSetTokens.has(token)) {
+            throw new JSONParserError(`Error assigning $ref pointer "${pointerPath}". \nUnsafe JSON Pointer token "${token}" cannot be used for assignment.`);
+        }
+    }
+}
 function unwrapOrThrow(value) {
     if (isHandledError(value)) {
         throw value;
@@ -327,3 +334,6 @@ function unwrapOrThrow(value) {
 function isRootPath(pathFromRoot) {
     return typeof pathFromRoot == "string" && Pointer.parse(pathFromRoot).length == 0;
 }
+function isAliasedResource($ref) {
+    return Boolean($ref.path && $ref.path in $ref.$refs._aliases);
+}

package/dist/lib/resolve-external.js

@@ -20,8 +20,11 @@ function resolveExternal(parser, options) {
         return Promise.resolve();
     }
     try {
+        const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+            ? getSchemaBasePath(parser.$refs._root$Ref.path, parser.schema)
+            : parser.$refs._root$Ref.path;
         // console.log('Resolving $ref pointers in %s', parser.$refs._root$Ref.path);
-        const promises = crawl(parser.schema, parser.$refs._root$Ref.path + "#", parser.$refs._root$Ref.path, parser.$refs._root$Ref.dynamicIdScope, parser.$refs, options);
+        const promises = crawl(parser.schema, parser.$refs._root$Ref.path + "#", rootScopeBase, parser.$refs._root$Ref.dynamicIdScope, parser.$refs, options);
         return Promise.all(promises);
     }
     catch (e) {
@@ -49,7 +52,7 @@ function crawl(obj, path, scopeBase, dynamicIdScope, $refs, options, seen, exter
     let promises = [];
     if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !seen.has(obj)) {
         seen.add(obj); // Track previously seen objects to avoid infinite recursion
-        const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+        const currentScopeBase = scopeBase;
         if ($Ref.isExternal$Ref(obj)) {
             promises.push(resolve$Ref(obj, path, currentScopeBase, dynamicIdScope, $refs, options));
         }
@@ -57,7 +60,9 @@ function crawl(obj, path, scopeBase, dynamicIdScope, $refs, options, seen, exter
         for (const key of keys) {
             const keyPath = Pointer.join(path, key);
             const value = obj[key];
-            const childScopeBase = dynamicIdScope && $Ref.isExternal$Ref(value) ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
+            const childScopeBase = dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+                ? getSchemaBasePath(currentScopeBase, value)
+                : currentScopeBase;
             promises = promises.concat(crawl(value, keyPath, childScopeBase, dynamicIdScope, $refs, options, seen, external));
         }
     }

package/dist/lib/resolvers/http.js

@@ -63,6 +63,9 @@ async function download(u, httpOptions, _redirects) {
     const redirects = _redirects || [];
     redirects.push(u.href);
     try {
+        if (httpOptions.safeUrlResolver && url.isUnsafeUrl(u.href)) {
+            throw new Error(`Unsafe URL blocked by safeUrlResolver: ${u.href}`);
+        }
         const res = await get(u, httpOptions);
         if (res.status >= 400) {
             const error = new Error(`HTTP ERROR ${res.status}`);
@@ -75,13 +78,14 @@ async function download(u, httpOptions, _redirects) {
                 error.status = res.status;
                 throw new ResolverError(error);
             }
-            else if (!("location" in res.headers) || !res.headers.location) {
-                const error = new Error(`HTTP ${res.status} redirect with no location header`);
-                error.status = res.status;
-                throw error;
-            }
             else {
-                const redirectTo = url.resolve(u.href, res.headers.location);
+                const location = getHeader(res, "location");
+                if (!location) {
+                    const error = new Error(`HTTP ${res.status} redirect with no location header`);
+                    error.status = res.status;
+                    throw error;
+                }
+                const redirectTo = url.resolve(u.href, location);
                 return download(redirectTo, httpOptions, redirects);
             }
         }
@@ -114,6 +118,7 @@ async function get(u, httpOptions) {
         method: "GET",
         headers: httpOptions.headers || {},
         credentials: httpOptions.withCredentials ? "include" : "same-origin",
+        redirect: "manual",
         signal: controller ? controller.signal : null,
     });
     if (timeoutId) {
@@ -121,3 +126,6 @@ async function get(u, httpOptions) {
     }
     return response;
 }
+function getHeader(response, name) {
+    return response.headers.get(name);
+}

package/dist/lib/util/url.js

@@ -4,7 +4,7 @@ const protocolPattern = /^(\w{2,}):\/\//i;
 const jsonPointerSlash = /~1/g;
 const jsonPointerTilde = /~0/g;
 import { isWindows } from "./is-windows.js";
-const isAbsoluteWin32Path = /^[a-zA-Z]:\\/;
+const isAbsoluteWin32Path = /^[a-zA-Z]:[\\/]/;
 // RegExp patterns to URL-encode special characters in local filesystem paths
 const urlEncodePatterns = [
     [/\?/g, "%3F"],
@@ -12,6 +12,7 @@ const urlEncodePatterns = [
 ];
 // RegExp patterns to URL-decode special characters for local filesystem paths
 const urlDecodePatterns = [/%23/g, "#", /%24/g, "$", /%26/g, "&", /%2C/g, ",", /%40/g, "@"];
+const unsafeDomainSuffixes = [".localhost", ".local", ".internal", ".intranet", ".corp", ".home", ".lan"];
 export const parse = (u) => new URL(u);
 /**
  * Returns resolved target URL relative to a base URL in a manner similar to that of a Web browser resolving an anchor tag HREF.
@@ -191,53 +192,10 @@ export function isUnsafeUrl(path) {
     if (typeof window !== "undefined" && window.location && window.location.href) {
         return false;
     }
-    // Local/internal network addresses
-    const localPatterns = [
-        // Localhost variations
-        "localhost",
-        "127.0.0.1",
-        "::1",
-        // Private IP ranges (RFC 1918)
-        "10.",
-        "172.16.",
-        "172.17.",
-        "172.18.",
-        "172.19.",
-        "172.20.",
-        "172.21.",
-        "172.22.",
-        "172.23.",
-        "172.24.",
-        "172.25.",
-        "172.26.",
-        "172.27.",
-        "172.28.",
-        "172.29.",
-        "172.30.",
-        "172.31.",
-        "192.168.",
-        // Link-local addresses
-        "169.254.",
-        // Internal domains
-        ".local",
-        ".internal",
-        ".intranet",
-        ".corp",
-        ".home",
-        ".lan",
-    ];
     try {
         // Try to parse as URL
         const url = new URL(normalizedPath.startsWith("//") ? "http:" + normalizedPath : normalizedPath);
-        const hostname = url.hostname.toLowerCase();
-        // Check against local patterns
-        for (const pattern of localPatterns) {
-            if (hostname === pattern || hostname.startsWith(pattern) || hostname.endsWith(pattern)) {
-                return true;
-            }
-        }
-        // Check for IP addresses in private ranges
-        if (isPrivateIP(hostname)) {
+        if (isUnsafeHostname(url.hostname)) {
             return true;
         }
         // Check for non-standard ports that might indicate internal services
@@ -252,32 +210,157 @@ export function isUnsafeUrl(path) {
         if (normalizedPath.startsWith("/") && !normalizedPath.startsWith("//")) {
             return false;
         }
-        // Check for localhost patterns in non-URL strings
-        for (const pattern of localPatterns) {
-            if (normalizedPath.includes(pattern)) {
-                return true;
-            }
+        if (containsUnsafeHostname(normalizedPath)) {
+            return true;
         }
     }
     return false;
 }
 /**
- * Helper function to check if an IP address is in a private range
+ * Helper function to check if a hostname is local or resolves to a non-public literal address.
  */
-function isPrivateIP(ip) {
-    const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-    const match = ip.match(ipRegex);
-    if (!match) {
-        return false;
+function isUnsafeHostname(hostname) {
+    const normalizedHostname = normalizeHostname(hostname);
+    if (!normalizedHostname) {
+        return true;
+    }
+    if (normalizedHostname === "localhost" || unsafeDomainSuffixes.some((suffix) => normalizedHostname.endsWith(suffix))) {
+        return true;
     }
-    const [, a, b, c, d] = match.map(Number);
-    // Validate IP format
-    if (a > 255 || b > 255 || c > 255 || d > 255) {
+    const ipv4 = parseIPv4Address(normalizedHostname);
+    if (ipv4) {
+        return isUnsafeIPv4Address(ipv4);
+    }
+    const ipv6 = parseIPv6Address(normalizedHostname);
+    if (ipv6) {
+        return isUnsafeIPv6Address(ipv6);
+    }
+    return false;
+}
+function normalizeHostname(hostname) {
+    let normalizedHostname = hostname.trim().toLowerCase();
+    if (normalizedHostname.startsWith("[") && normalizedHostname.endsWith("]")) {
+        normalizedHostname = normalizedHostname.slice(1, -1);
+    }
+    while (normalizedHostname.endsWith(".")) {
+        normalizedHostname = normalizedHostname.slice(0, -1);
+    }
+    return normalizedHostname;
+}
+function parseIPv4Address(ip) {
+    const parts = ip.split(".");
+    if (parts.length !== 4) {
+        return undefined;
+    }
+    const octets = parts.map((part) => {
+        if (!/^\d+$/.test(part)) {
+            return Number.NaN;
+        }
+        return Number(part);
+    });
+    if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+        return undefined;
+    }
+    return octets;
+}
+/**
+ * Helper function to check if an IPv4 address is in a non-public range.
+ */
+function isUnsafeIPv4Address([a, b, c, d]) {
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0 && c === 0) ||
+        (a === 192 && b === 168) ||
+        (a === 198 && (b === 18 || b === 19)) ||
+        a >= 224 ||
+        (a === 255 && b === 255 && c === 255 && d === 255));
+}
+function parseIPv6Address(ip) {
+    if (!ip.includes(":")) {
+        return undefined;
+    }
+    let normalizedIP = ip;
+    const lastSeparator = normalizedIP.lastIndexOf(":");
+    const possibleIPv4 = normalizedIP.slice(lastSeparator + 1);
+    if (possibleIPv4.includes(".")) {
+        const ipv4 = parseIPv4Address(possibleIPv4);
+        if (!ipv4) {
+            return undefined;
+        }
+        const firstGroup = ipv4[0] * 256 + ipv4[1];
+        const secondGroup = ipv4[2] * 256 + ipv4[3];
+        normalizedIP = `${normalizedIP.slice(0, lastSeparator + 1)}${firstGroup.toString(16)}:${secondGroup.toString(16)}`;
+    }
+    const halves = normalizedIP.split("::");
+    if (halves.length > 2) {
+        return undefined;
+    }
+    const head = parseIPv6Groups(halves[0]);
+    const tail = halves.length === 2 ? parseIPv6Groups(halves[1]) : [];
+    if (!head || !tail) {
+        return undefined;
+    }
+    if (halves.length === 1) {
+        return head.length === 8 ? head : undefined;
+    }
+    const missingGroups = 8 - head.length - tail.length;
+    if (missingGroups < 1) {
+        return undefined;
+    }
+    return [...head, ...Array(missingGroups).fill(0), ...tail];
+}
+function parseIPv6Groups(groups) {
+    if (!groups) {
+        return [];
+    }
+    const parsedGroups = groups.split(":").map((group) => {
+        if (!/^[\da-f]{1,4}$/i.test(group)) {
+            return Number.NaN;
+        }
+        return Number.parseInt(group, 16);
+    });
+    if (parsedGroups.some((group) => !Number.isInteger(group) || group < 0 || group > 0xffff)) {
+        return undefined;
+    }
+    return parsedGroups;
+}
+/**
+ * Helper function to check if an IPv6 address is in a non-public range.
+ */
+function isUnsafeIPv6Address(groups) {
+    if (groups.length !== 8) {
         return false;
     }
-    // Private IP ranges
-    return (a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254) // Link-local
-    );
+    const isUnspecified = groups.every((group) => group === 0);
+    const isLoopback = groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1;
+    const isUniqueLocal = (groups[0] & 0xfe00) === 0xfc00;
+    const isLinkLocal = (groups[0] & 0xffc0) === 0xfe80;
+    const isMulticast = (groups[0] & 0xff00) === 0xff00;
+    if (isUnspecified || isLoopback || isUniqueLocal || isLinkLocal || isMulticast) {
+        return true;
+    }
+    const mappedIPv4 = getMappedIPv4Address(groups);
+    return mappedIPv4 ? isUnsafeIPv4Address(mappedIPv4) : false;
+}
+function getMappedIPv4Address(groups) {
+    const firstFiveGroupsAreZero = groups.slice(0, 5).every((group) => group === 0);
+    const firstSixGroupsAreZero = firstFiveGroupsAreZero && groups[5] === 0;
+    const isIPv4Mapped = firstFiveGroupsAreZero && groups[5] === 0xffff;
+    if (!firstSixGroupsAreZero && !isIPv4Mapped) {
+        return undefined;
+    }
+    return [Math.floor(groups[6] / 256), groups[6] % 256, Math.floor(groups[7] / 256), groups[7] % 256];
+}
+function containsUnsafeHostname(value) {
+    const candidates = value
+        .split(/[\s/?#]+/)
+        .map((candidate) => candidate.replace(/^[a-z][\d+.a-z-]*:\/\//i, "").replace(/:\d+$/, ""))
+        .filter(Boolean);
+    return candidates.some((candidate) => isUnsafeHostname(candidate));
 }
 /**
  * Helper function to check if a port is typically used for internal services
@@ -381,6 +464,9 @@ export function fromFileSystemPath(path) {
  * Converts a URL to a local filesystem path.
  */
 export function toFileSystemPath(path, keepFileProtocol) {
+    // Bare "%" characters are valid in filesystem paths, but they make `decodeURI` throw.
+    // Escape only the non-encoded ones so percent-encoded sequences still decode normally.
+    path = path.replace(/%(?![0-9A-Fa-f]{2})/g, "%25");
     // Step 1: `decodeURI` will decode characters such as Cyrillic characters, spaces, etc.
     path = decodeURI(path);
     // Step 2: Manually decode characters that are not decoded by `decodeURI`.

package/lib/bundle.ts

@@ -35,6 +35,9 @@ function bundle<S extends object = JSONSchema, O extends ParserOptions<S> = Pars
   options: O,
 ) {
   // console.log('Bundling $ref pointers in %s', parser.$refs._root$Ref.path);
+  const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+    ? getSchemaBasePath(parser.$refs._root$Ref.path!, parser.schema)
+    : parser.$refs._root$Ref.path!;
 
   // Build an inventory of all $ref pointers in the JSON Schema
   const inventory: InventoryEntry[] = [];
@@ -42,7 +45,7 @@ function bundle<S extends object = JSONSchema, O extends ParserOptions<S> = Pars
     parser,
     "schema",
     parser.$refs._root$Ref.path + "#",
-    parser.$refs._root$Ref.path!,
+    rootScopeBase,
     parser.$refs._root$Ref.dynamicIdScope,
     "#",
     0,
@@ -96,7 +99,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
   const isExcludedPath = bundleOptions.excludedPathMatcher || (() => false);
 
   if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
-    const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+    const currentScopeBase = scopeBase;
     if ($Ref.isAllowed$Ref(obj)) {
       inventory$Ref(parent, key, path, currentScopeBase, dynamicIdScope, pathFromRoot, indirections, inventory, $refs, options);
     } else {
@@ -121,14 +124,17 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
         const keyPath = Pointer.join(path, key);
         const keyPathFromRoot = Pointer.join(pathFromRoot, key);
         const value = obj[key];
+        const childScopeBase =
+          dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+            ? getSchemaBasePath(currentScopeBase, value)
+            : currentScopeBase;
 
         if ($Ref.isAllowed$Ref(value)) {
-          const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
           inventory$Ref(
             obj,
             key,
             keyPath,
-            valueScopeBase,
+            childScopeBase,
             dynamicIdScope,
             keyPathFromRoot,
             indirections,
@@ -137,7 +143,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
             options,
           );
         } else {
-          crawl(obj, key, keyPath, currentScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
+          crawl(obj, key, keyPath, childScopeBase, dynamicIdScope, keyPathFromRoot, indirections, inventory, $refs, options);
         }
 
         // We need to ensure that we have an object to work with here because we may be crawling

package/lib/dereference.ts

@@ -21,11 +21,14 @@ function dereference<S extends object = JSONSchema, O extends ParserOptions<S> =
   options: O,
 ) {
   const start = Date.now();
+  const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+    ? getSchemaBasePath(parser.$refs._root$Ref.path!, parser.schema)
+    : parser.$refs._root$Ref.path!;
   // console.log('Dereferencing $ref pointers in %s', parser.$refs._root$Ref.path);
   const dereferenced = crawl<S, O>(
     parser.schema,
     parser.$refs._root$Ref.path!,
-    parser.$refs._root$Ref.path!,
+    rootScopeBase,
     parser.$refs._root$Ref.dynamicIdScope,
     "#",
     new Set(),
@@ -92,7 +95,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
     if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !isExcludedPath(pathFromRoot)) {
       parents.add(obj);
       processedObjects.add(obj);
-      const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+      const currentScopeBase = scopeBase;
 
       if ($Ref.isAllowed$Ref(obj, options)) {
         dereferenced = dereference$Ref(
@@ -123,14 +126,17 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
           }
 
           const value = obj[key];
+          const childScopeBase =
+            dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+              ? getSchemaBasePath(currentScopeBase, value)
+              : currentScopeBase;
           let circular;
 
           if ($Ref.isAllowed$Ref(value, options)) {
-            const valueScopeBase = dynamicIdScope ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
             dereferenced = dereference$Ref(
               value,
               keyPath,
-              valueScopeBase,
+              childScopeBase,
               dynamicIdScope,
               keyPathFromRoot,
               parents,
@@ -183,7 +189,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
               dereferenced = crawl(
                 value,
                 keyPath,
-                currentScopeBase,
+                childScopeBase,
                 dynamicIdScope,
                 keyPathFromRoot,
                 parents,

package/lib/pointer.ts

@@ -13,6 +13,7 @@ const slashes = /\//g;
 const tildes = /~/g;
 const escapedSlash = /~1/g;
 const escapedTilde = /~0/g;
+const unsafeSetTokens = new Set(["__proto__", "constructor", "prototype"]);
 
 /**
  * This class represents a single JSON pointer and its resolved value.
@@ -95,7 +96,7 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
 
     // Crawl the object, one token at a time
     this.value = unwrapOrThrow(obj);
-    if (this.$ref.dynamicIdScope) {
+    if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
       this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
     }
 
@@ -194,9 +195,11 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
       return value;
     }
 
+    assertSafeSetTokens(this.path, tokens);
+
     // Crawl the object, one token at a time
     this.value = unwrapOrThrow(obj);
-    if (this.$ref.dynamicIdScope) {
+    if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
       this.scopeBase = getSchemaBasePath(this.scopeBase, this.value);
     }
 
@@ -327,18 +330,16 @@ function resolveIf$Ref<S extends object = JSONSchema, O extends ParserOptions<S>
         // This JSON reference "extends" the resolved value, rather than simply pointing to it.
         // So the resolved path does NOT change.  Just the value does.
         pointer.value = $Ref.dereference(pointer.value, resolved.value, options);
-        if (pointer.$ref.dynamicIdScope) {
-          pointer.scopeBase = getSchemaBasePath(pointer.scopeBase, pointer.value);
-        }
         return false;
       } else {
         // Resolve the reference
         pointer.$ref = resolved.$ref;
         pointer.path = resolved.path;
         pointer.value = resolved.value;
-        pointer.scopeBase = pointer.$ref.dynamicIdScope
-          ? getSchemaBasePath(pointer.$ref.path!, pointer.value)
-          : pointer.$ref.path!;
+        // `pointer.$ref.path` is already the canonical location of the resolved resource.
+        // Re-applying the resource's own `$id` here would duplicate nested path segments
+        // such as `nested/nested/foo.json`.
+        pointer.scopeBase = pointer.$ref.path!;
       }
 
       return true;
@@ -374,6 +375,16 @@ function setValue(pointer: Pointer, token: string, value: JSONSchema4Type | JSON
   return value;
 }
 
+function assertSafeSetTokens(pointerPath: string, tokens: string[]) {
+  for (const token of tokens) {
+    if (unsafeSetTokens.has(token)) {
+      throw new JSONParserError(
+        `Error assigning $ref pointer "${pointerPath}". \nUnsafe JSON Pointer token "${token}" cannot be used for assignment.`,
+      );
+    }
+  }
+}
+
 function unwrapOrThrow(value: unknown) {
   if (isHandledError(value)) {
     throw value;
@@ -385,3 +396,7 @@ function unwrapOrThrow(value: unknown) {
 function isRootPath(pathFromRoot: string | unknown): boolean {
   return typeof pathFromRoot == "string" && Pointer.parse(pathFromRoot).length == 0;
 }
+
+function isAliasedResource($ref: $Ref<any, any>) {
+  return Boolean($ref.path && $ref.path in $ref.$refs._aliases);
+}

package/lib/resolve-external.ts

@@ -29,11 +29,14 @@ function resolveExternal<S extends object = JSONSchema, O extends ParserOptions<
   }
 
   try {
+    const rootScopeBase = parser.$refs._root$Ref.dynamicIdScope
+      ? getSchemaBasePath(parser.$refs._root$Ref.path!, parser.schema)
+      : parser.$refs._root$Ref.path!;
     // console.log('Resolving $ref pointers in %s', parser.$refs._root$Ref.path);
     const promises = crawl(
       parser.schema,
       parser.$refs._root$Ref.path + "#",
-      parser.$refs._root$Ref.path!,
+      rootScopeBase,
       parser.$refs._root$Ref.dynamicIdScope,
       parser.$refs,
       options,
@@ -75,7 +78,7 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
 
   if (obj && typeof obj === "object" && !ArrayBuffer.isView(obj) && !seen.has(obj)) {
     seen.add(obj); // Track previously seen objects to avoid infinite recursion
-    const currentScopeBase = dynamicIdScope ? getSchemaBasePath(scopeBase, obj) : scopeBase;
+    const currentScopeBase = scopeBase;
     if ($Ref.isExternal$Ref(obj)) {
       promises.push(resolve$Ref<S, O>(obj, path, currentScopeBase, dynamicIdScope, $refs, options));
     }
@@ -85,7 +88,9 @@ function crawl<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
       const keyPath = Pointer.join(path, key);
       const value = obj[key as keyof typeof obj] as string | JSONSchema | Buffer | undefined;
       const childScopeBase =
-        dynamicIdScope && $Ref.isExternal$Ref(value) ? getSchemaBasePath(currentScopeBase, value) : currentScopeBase;
+        dynamicIdScope && value && typeof value === "object" && !ArrayBuffer.isView(value)
+          ? getSchemaBasePath(currentScopeBase, value)
+          : currentScopeBase;
       promises = promises.concat(crawl(value, keyPath, childScopeBase, dynamicIdScope, $refs, options, seen, external));
     }
   }

package/lib/resolvers/http.ts

@@ -80,6 +80,10 @@ async function download<S extends object = JSONSchema>(
   redirects.push(u.href);
 
   try {
+    if (httpOptions.safeUrlResolver && url.isUnsafeUrl(u.href)) {
+      throw new Error(`Unsafe URL blocked by safeUrlResolver: ${u.href}`);
+    }
+
     const res = await get(u, httpOptions);
     if (res.status >= 400) {
       const error = new Error(`HTTP ERROR ${res.status}`) as Error & { status?: number };
@@ -92,12 +96,16 @@ async function download<S extends object = JSONSchema>(
         ) as Error & { status?: number };
         error.status = res.status;
         throw new ResolverError(error);
-      } else if (!("location" in res.headers) || !res.headers.location) {
-        const error = new Error(`HTTP ${res.status} redirect with no location header`) as Error & { status?: number };
-        error.status = res.status;
-        throw error;
       } else {
-        const redirectTo = url.resolve(u.href, res.headers.location as string);
+        const location = getHeader(res, "location");
+
+        if (!location) {
+          const error = new Error(`HTTP ${res.status} redirect with no location header`) as Error & { status?: number };
+          error.status = res.status;
+          throw error;
+        }
+
+        const redirectTo = url.resolve(u.href, location);
         return download(redirectTo, httpOptions, redirects);
       }
     } else {
@@ -130,6 +138,7 @@ async function get<S extends object = JSONSchema>(u: RequestInfo | URL, httpOpti
     method: "GET",
     headers: httpOptions.headers || {},
     credentials: httpOptions.withCredentials ? "include" : "same-origin",
+    redirect: "manual",
     signal: controller ? controller.signal : null,
   });
   if (timeoutId) {
@@ -138,3 +147,7 @@ async function get<S extends object = JSONSchema>(u: RequestInfo | URL, httpOpti
 
   return response;
 }
+
+function getHeader(response: Response, name: string): string | null {
+  return response.headers.get(name);
+}

package/lib/util/url.ts

@@ -7,7 +7,7 @@ const jsonPointerTilde = /~0/g;
 
 import { isWindows } from "./is-windows.js";
 
-const isAbsoluteWin32Path = /^[a-zA-Z]:\\/;
+const isAbsoluteWin32Path = /^[a-zA-Z]:[\\/]/;
 
 // RegExp patterns to URL-encode special characters in local filesystem paths
 const urlEncodePatterns = [
@@ -18,6 +18,8 @@ const urlEncodePatterns = [
 // RegExp patterns to URL-decode special characters for local filesystem paths
 const urlDecodePatterns = [/%23/g, "#", /%24/g, "$", /%26/g, "&", /%2C/g, ",", /%40/g, "@"];
 
+const unsafeDomainSuffixes = [".localhost", ".local", ".internal", ".intranet", ".corp", ".home", ".lan"];
+
 export const parse = (u: string | URL) => new URL(u);
 
 /**
@@ -211,60 +213,11 @@ export function isUnsafeUrl(path: string | unknown): boolean {
     return false;
   }
 
-  // Local/internal network addresses
-  const localPatterns = [
-    // Localhost variations
-    "localhost",
-    "127.0.0.1",
-    "::1",
-
-    // Private IP ranges (RFC 1918)
-    "10.",
-    "172.16.",
-    "172.17.",
-    "172.18.",
-    "172.19.",
-    "172.20.",
-    "172.21.",
-    "172.22.",
-    "172.23.",
-    "172.24.",
-    "172.25.",
-    "172.26.",
-    "172.27.",
-    "172.28.",
-    "172.29.",
-    "172.30.",
-    "172.31.",
-    "192.168.",
-
-    // Link-local addresses
-    "169.254.",
-
-    // Internal domains
-    ".local",
-    ".internal",
-    ".intranet",
-    ".corp",
-    ".home",
-    ".lan",
-  ];
-
   try {
     // Try to parse as URL
     const url = new URL(normalizedPath.startsWith("//") ? "http:" + normalizedPath : normalizedPath);
 
-    const hostname = url.hostname.toLowerCase();
-
-    // Check against local patterns
-    for (const pattern of localPatterns) {
-      if (hostname === pattern || hostname.startsWith(pattern) || hostname.endsWith(pattern)) {
-        return true;
-      }
-    }
-
-    // Check for IP addresses in private ranges
-    if (isPrivateIP(hostname)) {
+    if (isUnsafeHostname(url.hostname)) {
       return true;
     }
 
@@ -281,11 +234,8 @@ export function isUnsafeUrl(path: string | unknown): boolean {
       return false;
     }
 
-    // Check for localhost patterns in non-URL strings
-    for (const pattern of localPatterns) {
-      if (normalizedPath.includes(pattern)) {
-        return true;
-      }
+    if (containsUnsafeHostname(normalizedPath)) {
+      return true;
     }
   }
 
@@ -293,29 +243,198 @@ export function isUnsafeUrl(path: string | unknown): boolean {
 }
 
 /**
- * Helper function to check if an IP address is in a private range
+ * Helper function to check if a hostname is local or resolves to a non-public literal address.
  */
-function isPrivateIP(ip: string): boolean {
-  const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-  const match = ip.match(ipRegex);
+function isUnsafeHostname(hostname: string): boolean {
+  const normalizedHostname = normalizeHostname(hostname);
 
-  if (!match) {
-    return false;
+  if (!normalizedHostname) {
+    return true;
   }
 
-  const [, a, b, c, d] = match.map(Number);
+  if (normalizedHostname === "localhost" || unsafeDomainSuffixes.some((suffix) => normalizedHostname.endsWith(suffix))) {
+    return true;
+  }
 
-  // Validate IP format
-  if (a > 255 || b > 255 || c > 255 || d > 255) {
-    return false;
+  const ipv4 = parseIPv4Address(normalizedHostname);
+  if (ipv4) {
+    return isUnsafeIPv4Address(ipv4);
+  }
+
+  const ipv6 = parseIPv6Address(normalizedHostname);
+  if (ipv6) {
+    return isUnsafeIPv6Address(ipv6);
   }
 
-  // Private IP ranges
+  return false;
+}
+
+function normalizeHostname(hostname: string): string {
+  let normalizedHostname = hostname.trim().toLowerCase();
+
+  if (normalizedHostname.startsWith("[") && normalizedHostname.endsWith("]")) {
+    normalizedHostname = normalizedHostname.slice(1, -1);
+  }
+
+  while (normalizedHostname.endsWith(".")) {
+    normalizedHostname = normalizedHostname.slice(0, -1);
+  }
+
+  return normalizedHostname;
+}
+
+function parseIPv4Address(ip: string): number[] | undefined {
+  const parts = ip.split(".");
+
+  if (parts.length !== 4) {
+    return undefined;
+  }
+
+  const octets = parts.map((part) => {
+    if (!/^\d+$/.test(part)) {
+      return Number.NaN;
+    }
+
+    return Number(part);
+  });
+
+  if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+    return undefined;
+  }
+
+  return octets;
+}
+
+/**
+ * Helper function to check if an IPv4 address is in a non-public range.
+ */
+function isUnsafeIPv4Address([a, b, c, d]: number[]): boolean {
   return (
-    a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254) // Link-local
+    a === 0 ||
+    a === 10 ||
+    a === 127 ||
+    (a === 100 && b >= 64 && b <= 127) ||
+    (a === 169 && b === 254) ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 0 && c === 0) ||
+    (a === 192 && b === 168) ||
+    (a === 198 && (b === 18 || b === 19)) ||
+    a >= 224 ||
+    (a === 255 && b === 255 && c === 255 && d === 255)
   );
 }
 
+function parseIPv6Address(ip: string): number[] | undefined {
+  if (!ip.includes(":")) {
+    return undefined;
+  }
+
+  let normalizedIP = ip;
+  const lastSeparator = normalizedIP.lastIndexOf(":");
+  const possibleIPv4 = normalizedIP.slice(lastSeparator + 1);
+
+  if (possibleIPv4.includes(".")) {
+    const ipv4 = parseIPv4Address(possibleIPv4);
+
+    if (!ipv4) {
+      return undefined;
+    }
+
+    const firstGroup = ipv4[0] * 256 + ipv4[1];
+    const secondGroup = ipv4[2] * 256 + ipv4[3];
+    normalizedIP = `${normalizedIP.slice(0, lastSeparator + 1)}${firstGroup.toString(16)}:${secondGroup.toString(16)}`;
+  }
+
+  const halves = normalizedIP.split("::");
+
+  if (halves.length > 2) {
+    return undefined;
+  }
+
+  const head = parseIPv6Groups(halves[0]);
+  const tail = halves.length === 2 ? parseIPv6Groups(halves[1]) : [];
+
+  if (!head || !tail) {
+    return undefined;
+  }
+
+  if (halves.length === 1) {
+    return head.length === 8 ? head : undefined;
+  }
+
+  const missingGroups = 8 - head.length - tail.length;
+
+  if (missingGroups < 1) {
+    return undefined;
+  }
+
+  return [...head, ...Array<number>(missingGroups).fill(0), ...tail];
+}
+
+function parseIPv6Groups(groups: string): number[] | undefined {
+  if (!groups) {
+    return [];
+  }
+
+  const parsedGroups = groups.split(":").map((group) => {
+    if (!/^[\da-f]{1,4}$/i.test(group)) {
+      return Number.NaN;
+    }
+
+    return Number.parseInt(group, 16);
+  });
+
+  if (parsedGroups.some((group) => !Number.isInteger(group) || group < 0 || group > 0xffff)) {
+    return undefined;
+  }
+
+  return parsedGroups;
+}
+
+/**
+ * Helper function to check if an IPv6 address is in a non-public range.
+ */
+function isUnsafeIPv6Address(groups: number[]): boolean {
+  if (groups.length !== 8) {
+    return false;
+  }
+
+  const isUnspecified = groups.every((group) => group === 0);
+  const isLoopback = groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1;
+  const isUniqueLocal = (groups[0] & 0xfe00) === 0xfc00;
+  const isLinkLocal = (groups[0] & 0xffc0) === 0xfe80;
+  const isMulticast = (groups[0] & 0xff00) === 0xff00;
+
+  if (isUnspecified || isLoopback || isUniqueLocal || isLinkLocal || isMulticast) {
+    return true;
+  }
+
+  const mappedIPv4 = getMappedIPv4Address(groups);
+
+  return mappedIPv4 ? isUnsafeIPv4Address(mappedIPv4) : false;
+}
+
+function getMappedIPv4Address(groups: number[]): number[] | undefined {
+  const firstFiveGroupsAreZero = groups.slice(0, 5).every((group) => group === 0);
+  const firstSixGroupsAreZero = firstFiveGroupsAreZero && groups[5] === 0;
+  const isIPv4Mapped = firstFiveGroupsAreZero && groups[5] === 0xffff;
+
+  if (!firstSixGroupsAreZero && !isIPv4Mapped) {
+    return undefined;
+  }
+
+  return [Math.floor(groups[6] / 256), groups[6] % 256, Math.floor(groups[7] / 256), groups[7] % 256];
+}
+
+function containsUnsafeHostname(value: string): boolean {
+  const candidates = value
+    .split(/[\s/?#]+/)
+    .map((candidate) => candidate.replace(/^[a-z][\d+.a-z-]*:\/\//i, "").replace(/:\d+$/, ""))
+    .filter(Boolean);
+
+  return candidates.some((candidate) => isUnsafeHostname(candidate));
+}
+
 /**
  * Helper function to check if a port is typically used for internal services
  */
@@ -426,6 +545,10 @@ export function fromFileSystemPath(path: string) {
  * Converts a URL to a local filesystem path.
  */
 export function toFileSystemPath(path: string | undefined, keepFileProtocol?: boolean): string {
+  // Bare "%" characters are valid in filesystem paths, but they make `decodeURI` throw.
+  // Escape only the non-encoded ones so percent-encoded sequences still decode normally.
+  path = path!.replace(/%(?![0-9A-Fa-f]{2})/g, "%25");
+
   // Step 1: `decodeURI` will decode characters such as Cyrillic characters, spaces, etc.
   path = decodeURI(path!);
 

package/package.json

@@ -1,21 +1,21 @@
 {
   "name": "@apidevtools/json-schema-ref-parser",
-  "version": "15.3.4",
+  "version": "15.3.6",
   "description": "Parse, Resolve, and Dereference JSON Schema $ref pointers",
   "type": "module",
   "types": "dist/lib/index.d.ts",
   "module": "dist/lib/index.js",
   "main": "dist/lib/index.js",
   "scripts": {
-    "prepublishOnly": "yarn build",
+    "prepublishOnly": "pnpm build",
     "lint": "eslint lib",
     "build": "rimraf dist && tsc",
     "typecheck": "tsc --noEmit",
     "prettier": "prettier --write \"**/*.+(js|jsx|ts|tsx|har||json|css|md)\"",
     "test": "vitest --coverage",
     "test:specific": "vitest invalid",
-    "test:node": "yarn test",
-    "test:browser": "cross-env BROWSER=\"true\" yarn test",
+    "test:node": "pnpm test",
+    "test:browser": "node ./test/fixtures/run-browser-tests.mjs",
     "test:update": "vitest -u",
     "test:watch": "vitest -w"
   },
@@ -72,32 +72,32 @@
     "@types/json-schema": "^7.0.15"
   },
   "dependencies": {
-    "js-yaml": "^4.1.1"
+    "js-yaml": "^4.2.0"
   },
   "devDependencies": {
-    "@eslint/compat": "^2.0.3",
+    "@eslint/compat": "^2.1.0",
     "@eslint/js": "^10.0.1",
     "@types/eslint": "^9.6.1",
     "@types/js-yaml": "^4.0.9",
     "@types/json-schema": "^7.0.15",
-    "@types/node": "^25",
-    "@typescript-eslint/eslint-plugin": "^8.57.2",
-    "@typescript-eslint/parser": "^8.57.2",
-    "@vitest/coverage-v8": "^4.1.2",
+    "@types/node": "^25.9.3",
+    "@typescript-eslint/eslint-plugin": "^8.61.0",
+    "@typescript-eslint/parser": "^8.61.0",
+    "@vitest/coverage-v8": "^4.1.8",
     "cross-env": "^10.1.0",
-    "eslint": "^10.1.0",
+    "eslint": "^10.4.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-prettier": "^5.5.5",
-    "eslint-plugin-promise": "^7.2.1",
+    "eslint-plugin-prettier": "^5.5.6",
+    "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-unused-imports": "^4.4.1",
-    "globals": "^17.4.0",
-    "jsdom": "^29.0.1",
-    "prettier": "^3.8.1",
+    "globals": "^17.6.0",
+    "jsdom": "^29.1.1",
+    "prettier": "^3.8.4",
     "rimraf": "^6.1.3",
-    "typescript": "^6.0.2",
-    "typescript-eslint": "^8.57.2",
-    "vitest": "^4.1.2"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.61.0",
+    "vitest": "^4.1.8"
   },
   "release": {
     "branches": [
@@ -110,5 +110,5 @@
       "@semantic-release/github"
     ]
   },
-  "packageManager": "yarn@4.13.0"
+  "packageManager": "pnpm@11.5.3"
 }