@apidevtools/json-schema-ref-parser 15.3.5 → 15.4.0

package/README.md

@@ -15,7 +15,7 @@ Install using [npm](https://docs.npmjs.com/about-npm/):
 
 ```bash
 npm install @apidevtools/json-schema-ref-parser
-yarn add @apidevtools/json-schema-ref-parser
+pnpm add @apidevtools/json-schema-ref-parser
 bun add @apidevtools/json-schema-ref-parser
 ```
 
@@ -142,10 +142,10 @@ To build/test the project locally on your computer:
    `git clone https://github.com/APIDevTools/json-schema-ref-parser.git`
 
 2. **Install dependencies**<br>
-   `yarn install`
+   `pnpm install`
 
 3. **Run the tests**<br>
-   `yarn test`
+   `pnpm test`
 
 ## License
 

package/dist/lib/bundle.d.ts

@@ -13,6 +13,7 @@ export interface InventoryEntry {
     circular: any;
     extended: any;
     external: any;
+    nestedResource: boolean;
     indirections: any;
 }
 /**

package/dist/lib/bundle.js

@@ -119,6 +119,7 @@ function inventory$Ref($refParent, $refKey, path, scopeBase, dynamicIdScope, pat
     const file = url.stripHash(pointer.path);
     const hash = url.getHash(pointer.path);
     const external = file !== $refs._root$Ref.path && !$refs._aliases[file];
+    const nestedResource = Boolean($refs._aliases[file]) && pointer.$ref.value !== $refs._root$Ref.value;
     const extended = $Ref.isExtended$Ref($ref);
     indirections += pointer.indirections;
     const existingEntry = findInInventory(inventory, $refParent, $refKey);
@@ -143,6 +144,7 @@ function inventory$Ref($refParent, $refKey, path, scopeBase, dynamicIdScope, pat
         circular: pointer.circular, // Is this $ref pointer DIRECTLY circular? (i.e. it references itself)
         extended, // Does this $ref extend its resolved value? (i.e. it has extra properties, in addition to "$ref")
         external, // Does this $ref pointer point to a file other than the main JSON Schema file?
+        nestedResource, // Does this $ref resolve to an embedded schema resource with its own $id?
         indirections, // The number of indirect references that were traversed to resolve the value
     });
     // Recursively crawl the resolved value
@@ -221,8 +223,10 @@ function remap(inventory, options, rootId) {
         if (!entry.external) {
             // This $ref already resolves to the main JSON Schema file.
             // When optimizeInternalRefs is false, preserve the original internal ref path
-            // instead of rewriting it to the fully resolved hash.
-            if (bundleOpts.optimizeInternalRefs !== false) {
+            // instead of rewriting it to the fully resolved hash. References to nested
+            // resources must also retain their resource URI so that "#" does not point
+            // at the document root instead.
+            if (bundleOpts.optimizeInternalRefs !== false && !entry.nestedResource) {
                 entry.$ref.$ref = entry.hash;
             }
         }

package/dist/lib/pointer.js

@@ -7,6 +7,7 @@ const slashes = /\//g;
 const tildes = /~/g;
 const escapedSlash = /~1/g;
 const escapedTilde = /~0/g;
+const unsafeSetTokens = new Set(["__proto__", "constructor", "prototype"]);
 /**
  * This class represents a single JSON pointer and its resolved value.
  *
@@ -161,6 +162,7 @@ class Pointer {
             this.value = value;
             return value;
         }
+        assertSafeSetTokens(this.path, tokens);
         // Crawl the object, one token at a time
         this.value = unwrapOrThrow(obj);
         if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
@@ -316,6 +318,13 @@ function setValue(pointer, token, value) {
     }
     return value;
 }
+function assertSafeSetTokens(pointerPath, tokens) {
+    for (const token of tokens) {
+        if (unsafeSetTokens.has(token)) {
+            throw new JSONParserError(`Error assigning $ref pointer "${pointerPath}". \nUnsafe JSON Pointer token "${token}" cannot be used for assignment.`);
+        }
+    }
+}
 function unwrapOrThrow(value) {
     if (isHandledError(value)) {
         throw value;

package/dist/lib/resolvers/http.js

@@ -63,6 +63,9 @@ async function download(u, httpOptions, _redirects) {
     const redirects = _redirects || [];
     redirects.push(u.href);
     try {
+        if (httpOptions.safeUrlResolver && url.isUnsafeUrl(u.href)) {
+            throw new Error(`Unsafe URL blocked by safeUrlResolver: ${u.href}`);
+        }
         const res = await get(u, httpOptions);
         if (res.status >= 400) {
             const error = new Error(`HTTP ERROR ${res.status}`);
@@ -75,13 +78,14 @@ async function download(u, httpOptions, _redirects) {
                 error.status = res.status;
                 throw new ResolverError(error);
             }
-            else if (!("location" in res.headers) || !res.headers.location) {
-                const error = new Error(`HTTP ${res.status} redirect with no location header`);
-                error.status = res.status;
-                throw error;
-            }
             else {
-                const redirectTo = url.resolve(u.href, res.headers.location);
+                const location = getHeader(res, "location");
+                if (!location) {
+                    const error = new Error(`HTTP ${res.status} redirect with no location header`);
+                    error.status = res.status;
+                    throw error;
+                }
+                const redirectTo = url.resolve(u.href, location);
                 return download(redirectTo, httpOptions, redirects);
             }
         }
@@ -114,6 +118,7 @@ async function get(u, httpOptions) {
         method: "GET",
         headers: httpOptions.headers || {},
         credentials: httpOptions.withCredentials ? "include" : "same-origin",
+        redirect: "manual",
         signal: controller ? controller.signal : null,
     });
     if (timeoutId) {
@@ -121,3 +126,6 @@ async function get(u, httpOptions) {
     }
     return response;
 }
+function getHeader(response, name) {
+    return response.headers.get(name);
+}

package/dist/lib/util/url.js

@@ -12,6 +12,7 @@ const urlEncodePatterns = [
 ];
 // RegExp patterns to URL-decode special characters for local filesystem paths
 const urlDecodePatterns = [/%23/g, "#", /%24/g, "$", /%26/g, "&", /%2C/g, ",", /%40/g, "@"];
+const unsafeDomainSuffixes = [".localhost", ".local", ".internal", ".intranet", ".corp", ".home", ".lan"];
 export const parse = (u) => new URL(u);
 /**
  * Returns resolved target URL relative to a base URL in a manner similar to that of a Web browser resolving an anchor tag HREF.
@@ -191,53 +192,10 @@ export function isUnsafeUrl(path) {
     if (typeof window !== "undefined" && window.location && window.location.href) {
         return false;
     }
-    // Local/internal network addresses
-    const localPatterns = [
-        // Localhost variations
-        "localhost",
-        "127.0.0.1",
-        "::1",
-        // Private IP ranges (RFC 1918)
-        "10.",
-        "172.16.",
-        "172.17.",
-        "172.18.",
-        "172.19.",
-        "172.20.",
-        "172.21.",
-        "172.22.",
-        "172.23.",
-        "172.24.",
-        "172.25.",
-        "172.26.",
-        "172.27.",
-        "172.28.",
-        "172.29.",
-        "172.30.",
-        "172.31.",
-        "192.168.",
-        // Link-local addresses
-        "169.254.",
-        // Internal domains
-        ".local",
-        ".internal",
-        ".intranet",
-        ".corp",
-        ".home",
-        ".lan",
-    ];
     try {
         // Try to parse as URL
         const url = new URL(normalizedPath.startsWith("//") ? "http:" + normalizedPath : normalizedPath);
-        const hostname = url.hostname.toLowerCase();
-        // Check against local patterns
-        for (const pattern of localPatterns) {
-            if (hostname === pattern || hostname.startsWith(pattern) || hostname.endsWith(pattern)) {
-                return true;
-            }
-        }
-        // Check for IP addresses in private ranges
-        if (isPrivateIP(hostname)) {
+        if (isUnsafeHostname(url.hostname)) {
             return true;
         }
         // Check for non-standard ports that might indicate internal services
@@ -252,32 +210,157 @@ export function isUnsafeUrl(path) {
         if (normalizedPath.startsWith("/") && !normalizedPath.startsWith("//")) {
             return false;
         }
-        // Check for localhost patterns in non-URL strings
-        for (const pattern of localPatterns) {
-            if (normalizedPath.includes(pattern)) {
-                return true;
-            }
+        if (containsUnsafeHostname(normalizedPath)) {
+            return true;
         }
     }
     return false;
 }
 /**
- * Helper function to check if an IP address is in a private range
+ * Helper function to check if a hostname is local or resolves to a non-public literal address.
  */
-function isPrivateIP(ip) {
-    const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-    const match = ip.match(ipRegex);
-    if (!match) {
-        return false;
+function isUnsafeHostname(hostname) {
+    const normalizedHostname = normalizeHostname(hostname);
+    if (!normalizedHostname) {
+        return true;
+    }
+    if (normalizedHostname === "localhost" || unsafeDomainSuffixes.some((suffix) => normalizedHostname.endsWith(suffix))) {
+        return true;
     }
-    const [, a, b, c, d] = match.map(Number);
-    // Validate IP format
-    if (a > 255 || b > 255 || c > 255 || d > 255) {
+    const ipv4 = parseIPv4Address(normalizedHostname);
+    if (ipv4) {
+        return isUnsafeIPv4Address(ipv4);
+    }
+    const ipv6 = parseIPv6Address(normalizedHostname);
+    if (ipv6) {
+        return isUnsafeIPv6Address(ipv6);
+    }
+    return false;
+}
+function normalizeHostname(hostname) {
+    let normalizedHostname = hostname.trim().toLowerCase();
+    if (normalizedHostname.startsWith("[") && normalizedHostname.endsWith("]")) {
+        normalizedHostname = normalizedHostname.slice(1, -1);
+    }
+    while (normalizedHostname.endsWith(".")) {
+        normalizedHostname = normalizedHostname.slice(0, -1);
+    }
+    return normalizedHostname;
+}
+function parseIPv4Address(ip) {
+    const parts = ip.split(".");
+    if (parts.length !== 4) {
+        return undefined;
+    }
+    const octets = parts.map((part) => {
+        if (!/^\d+$/.test(part)) {
+            return Number.NaN;
+        }
+        return Number(part);
+    });
+    if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+        return undefined;
+    }
+    return octets;
+}
+/**
+ * Helper function to check if an IPv4 address is in a non-public range.
+ */
+function isUnsafeIPv4Address([a, b, c, d]) {
+    return (a === 0 ||
+        a === 10 ||
+        a === 127 ||
+        (a === 100 && b >= 64 && b <= 127) ||
+        (a === 169 && b === 254) ||
+        (a === 172 && b >= 16 && b <= 31) ||
+        (a === 192 && b === 0 && c === 0) ||
+        (a === 192 && b === 168) ||
+        (a === 198 && (b === 18 || b === 19)) ||
+        a >= 224 ||
+        (a === 255 && b === 255 && c === 255 && d === 255));
+}
+function parseIPv6Address(ip) {
+    if (!ip.includes(":")) {
+        return undefined;
+    }
+    let normalizedIP = ip;
+    const lastSeparator = normalizedIP.lastIndexOf(":");
+    const possibleIPv4 = normalizedIP.slice(lastSeparator + 1);
+    if (possibleIPv4.includes(".")) {
+        const ipv4 = parseIPv4Address(possibleIPv4);
+        if (!ipv4) {
+            return undefined;
+        }
+        const firstGroup = ipv4[0] * 256 + ipv4[1];
+        const secondGroup = ipv4[2] * 256 + ipv4[3];
+        normalizedIP = `${normalizedIP.slice(0, lastSeparator + 1)}${firstGroup.toString(16)}:${secondGroup.toString(16)}`;
+    }
+    const halves = normalizedIP.split("::");
+    if (halves.length > 2) {
+        return undefined;
+    }
+    const head = parseIPv6Groups(halves[0]);
+    const tail = halves.length === 2 ? parseIPv6Groups(halves[1]) : [];
+    if (!head || !tail) {
+        return undefined;
+    }
+    if (halves.length === 1) {
+        return head.length === 8 ? head : undefined;
+    }
+    const missingGroups = 8 - head.length - tail.length;
+    if (missingGroups < 1) {
+        return undefined;
+    }
+    return [...head, ...Array(missingGroups).fill(0), ...tail];
+}
+function parseIPv6Groups(groups) {
+    if (!groups) {
+        return [];
+    }
+    const parsedGroups = groups.split(":").map((group) => {
+        if (!/^[\da-f]{1,4}$/i.test(group)) {
+            return Number.NaN;
+        }
+        return Number.parseInt(group, 16);
+    });
+    if (parsedGroups.some((group) => !Number.isInteger(group) || group < 0 || group > 0xffff)) {
+        return undefined;
+    }
+    return parsedGroups;
+}
+/**
+ * Helper function to check if an IPv6 address is in a non-public range.
+ */
+function isUnsafeIPv6Address(groups) {
+    if (groups.length !== 8) {
         return false;
     }
-    // Private IP ranges
-    return (a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254) // Link-local
-    );
+    const isUnspecified = groups.every((group) => group === 0);
+    const isLoopback = groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1;
+    const isUniqueLocal = (groups[0] & 0xfe00) === 0xfc00;
+    const isLinkLocal = (groups[0] & 0xffc0) === 0xfe80;
+    const isMulticast = (groups[0] & 0xff00) === 0xff00;
+    if (isUnspecified || isLoopback || isUniqueLocal || isLinkLocal || isMulticast) {
+        return true;
+    }
+    const mappedIPv4 = getMappedIPv4Address(groups);
+    return mappedIPv4 ? isUnsafeIPv4Address(mappedIPv4) : false;
+}
+function getMappedIPv4Address(groups) {
+    const firstFiveGroupsAreZero = groups.slice(0, 5).every((group) => group === 0);
+    const firstSixGroupsAreZero = firstFiveGroupsAreZero && groups[5] === 0;
+    const isIPv4Mapped = firstFiveGroupsAreZero && groups[5] === 0xffff;
+    if (!firstSixGroupsAreZero && !isIPv4Mapped) {
+        return undefined;
+    }
+    return [Math.floor(groups[6] / 256), groups[6] % 256, Math.floor(groups[7] / 256), groups[7] % 256];
+}
+function containsUnsafeHostname(value) {
+    const candidates = value
+        .split(/[\s/?#]+/)
+        .map((candidate) => candidate.replace(/^[a-z][\d+.a-z-]*:\/\//i, "").replace(/:\d+$/, ""))
+        .filter(Boolean);
+    return candidates.some((candidate) => isUnsafeHostname(candidate));
 }
 /**
  * Helper function to check if a port is typically used for internal services

package/lib/bundle.ts

@@ -20,6 +20,7 @@ export interface InventoryEntry {
   circular: any;
   extended: any;
   external: any;
+  nestedResource: boolean;
   indirections: any;
 }
 /**
@@ -194,6 +195,7 @@ function inventory$Ref<S extends object = JSONSchema, O extends ParserOptions<S>
   const file = url.stripHash(pointer.path);
   const hash = url.getHash(pointer.path);
   const external = file !== $refs._root$Ref.path && !$refs._aliases[file];
+  const nestedResource = Boolean($refs._aliases[file]) && pointer.$ref.value !== $refs._root$Ref.value;
   const extended = $Ref.isExtended$Ref($ref);
   indirections += pointer.indirections;
 
@@ -219,6 +221,7 @@ function inventory$Ref<S extends object = JSONSchema, O extends ParserOptions<S>
     circular: pointer.circular, // Is this $ref pointer DIRECTLY circular? (i.e. it references itself)
     extended, // Does this $ref extend its resolved value? (i.e. it has extra properties, in addition to "$ref")
     external, // Does this $ref pointer point to a file other than the main JSON Schema file?
+    nestedResource, // Does this $ref resolve to an embedded schema resource with its own $id?
     indirections, // The number of indirect references that were traversed to resolve the value
   });
 
@@ -316,8 +319,10 @@ function remap<S extends object = JSONSchema, O extends ParserOptions<S> = Parse
     if (!entry.external) {
       // This $ref already resolves to the main JSON Schema file.
       // When optimizeInternalRefs is false, preserve the original internal ref path
-      // instead of rewriting it to the fully resolved hash.
-      if (bundleOpts.optimizeInternalRefs !== false) {
+      // instead of rewriting it to the fully resolved hash. References to nested
+      // resources must also retain their resource URI so that "#" does not point
+      // at the document root instead.
+      if (bundleOpts.optimizeInternalRefs !== false && !entry.nestedResource) {
         entry.$ref.$ref = entry.hash;
       }
     } else if (entry.file === file && entry.hash === hash) {

package/lib/pointer.ts

@@ -13,6 +13,7 @@ const slashes = /\//g;
 const tildes = /~/g;
 const escapedSlash = /~1/g;
 const escapedTilde = /~0/g;
+const unsafeSetTokens = new Set(["__proto__", "constructor", "prototype"]);
 
 /**
  * This class represents a single JSON pointer and its resolved value.
@@ -194,6 +195,8 @@ class Pointer<S extends object = JSONSchema, O extends ParserOptions<S> = Parser
       return value;
     }
 
+    assertSafeSetTokens(this.path, tokens);
+
     // Crawl the object, one token at a time
     this.value = unwrapOrThrow(obj);
     if (this.$ref.dynamicIdScope && !isAliasedResource(this.$ref)) {
@@ -372,6 +375,16 @@ function setValue(pointer: Pointer, token: string, value: JSONSchema4Type | JSON
   return value;
 }
 
+function assertSafeSetTokens(pointerPath: string, tokens: string[]) {
+  for (const token of tokens) {
+    if (unsafeSetTokens.has(token)) {
+      throw new JSONParserError(
+        `Error assigning $ref pointer "${pointerPath}". \nUnsafe JSON Pointer token "${token}" cannot be used for assignment.`,
+      );
+    }
+  }
+}
+
 function unwrapOrThrow(value: unknown) {
   if (isHandledError(value)) {
     throw value;

package/lib/resolvers/http.ts

@@ -80,6 +80,10 @@ async function download<S extends object = JSONSchema>(
   redirects.push(u.href);
 
   try {
+    if (httpOptions.safeUrlResolver && url.isUnsafeUrl(u.href)) {
+      throw new Error(`Unsafe URL blocked by safeUrlResolver: ${u.href}`);
+    }
+
     const res = await get(u, httpOptions);
     if (res.status >= 400) {
       const error = new Error(`HTTP ERROR ${res.status}`) as Error & { status?: number };
@@ -92,12 +96,16 @@ async function download<S extends object = JSONSchema>(
         ) as Error & { status?: number };
         error.status = res.status;
         throw new ResolverError(error);
-      } else if (!("location" in res.headers) || !res.headers.location) {
-        const error = new Error(`HTTP ${res.status} redirect with no location header`) as Error & { status?: number };
-        error.status = res.status;
-        throw error;
       } else {
-        const redirectTo = url.resolve(u.href, res.headers.location as string);
+        const location = getHeader(res, "location");
+
+        if (!location) {
+          const error = new Error(`HTTP ${res.status} redirect with no location header`) as Error & { status?: number };
+          error.status = res.status;
+          throw error;
+        }
+
+        const redirectTo = url.resolve(u.href, location);
         return download(redirectTo, httpOptions, redirects);
       }
     } else {
@@ -130,6 +138,7 @@ async function get<S extends object = JSONSchema>(u: RequestInfo | URL, httpOpti
     method: "GET",
     headers: httpOptions.headers || {},
     credentials: httpOptions.withCredentials ? "include" : "same-origin",
+    redirect: "manual",
     signal: controller ? controller.signal : null,
   });
   if (timeoutId) {
@@ -138,3 +147,7 @@ async function get<S extends object = JSONSchema>(u: RequestInfo | URL, httpOpti
 
   return response;
 }
+
+function getHeader(response: Response, name: string): string | null {
+  return response.headers.get(name);
+}

package/lib/util/url.ts

@@ -18,6 +18,8 @@ const urlEncodePatterns = [
 // RegExp patterns to URL-decode special characters for local filesystem paths
 const urlDecodePatterns = [/%23/g, "#", /%24/g, "$", /%26/g, "&", /%2C/g, ",", /%40/g, "@"];
 
+const unsafeDomainSuffixes = [".localhost", ".local", ".internal", ".intranet", ".corp", ".home", ".lan"];
+
 export const parse = (u: string | URL) => new URL(u);
 
 /**
@@ -211,60 +213,11 @@ export function isUnsafeUrl(path: string | unknown): boolean {
     return false;
   }
 
-  // Local/internal network addresses
-  const localPatterns = [
-    // Localhost variations
-    "localhost",
-    "127.0.0.1",
-    "::1",
-
-    // Private IP ranges (RFC 1918)
-    "10.",
-    "172.16.",
-    "172.17.",
-    "172.18.",
-    "172.19.",
-    "172.20.",
-    "172.21.",
-    "172.22.",
-    "172.23.",
-    "172.24.",
-    "172.25.",
-    "172.26.",
-    "172.27.",
-    "172.28.",
-    "172.29.",
-    "172.30.",
-    "172.31.",
-    "192.168.",
-
-    // Link-local addresses
-    "169.254.",
-
-    // Internal domains
-    ".local",
-    ".internal",
-    ".intranet",
-    ".corp",
-    ".home",
-    ".lan",
-  ];
-
   try {
     // Try to parse as URL
     const url = new URL(normalizedPath.startsWith("//") ? "http:" + normalizedPath : normalizedPath);
 
-    const hostname = url.hostname.toLowerCase();
-
-    // Check against local patterns
-    for (const pattern of localPatterns) {
-      if (hostname === pattern || hostname.startsWith(pattern) || hostname.endsWith(pattern)) {
-        return true;
-      }
-    }
-
-    // Check for IP addresses in private ranges
-    if (isPrivateIP(hostname)) {
+    if (isUnsafeHostname(url.hostname)) {
       return true;
     }
 
@@ -281,11 +234,8 @@ export function isUnsafeUrl(path: string | unknown): boolean {
       return false;
     }
 
-    // Check for localhost patterns in non-URL strings
-    for (const pattern of localPatterns) {
-      if (normalizedPath.includes(pattern)) {
-        return true;
-      }
+    if (containsUnsafeHostname(normalizedPath)) {
+      return true;
     }
   }
 
@@ -293,29 +243,198 @@ export function isUnsafeUrl(path: string | unknown): boolean {
 }
 
 /**
- * Helper function to check if an IP address is in a private range
+ * Helper function to check if a hostname is local or resolves to a non-public literal address.
  */
-function isPrivateIP(ip: string): boolean {
-  const ipRegex = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
-  const match = ip.match(ipRegex);
+function isUnsafeHostname(hostname: string): boolean {
+  const normalizedHostname = normalizeHostname(hostname);
 
-  if (!match) {
-    return false;
+  if (!normalizedHostname) {
+    return true;
   }
 
-  const [, a, b, c, d] = match.map(Number);
+  if (normalizedHostname === "localhost" || unsafeDomainSuffixes.some((suffix) => normalizedHostname.endsWith(suffix))) {
+    return true;
+  }
 
-  // Validate IP format
-  if (a > 255 || b > 255 || c > 255 || d > 255) {
-    return false;
+  const ipv4 = parseIPv4Address(normalizedHostname);
+  if (ipv4) {
+    return isUnsafeIPv4Address(ipv4);
+  }
+
+  const ipv6 = parseIPv6Address(normalizedHostname);
+  if (ipv6) {
+    return isUnsafeIPv6Address(ipv6);
   }
 
-  // Private IP ranges
+  return false;
+}
+
+function normalizeHostname(hostname: string): string {
+  let normalizedHostname = hostname.trim().toLowerCase();
+
+  if (normalizedHostname.startsWith("[") && normalizedHostname.endsWith("]")) {
+    normalizedHostname = normalizedHostname.slice(1, -1);
+  }
+
+  while (normalizedHostname.endsWith(".")) {
+    normalizedHostname = normalizedHostname.slice(0, -1);
+  }
+
+  return normalizedHostname;
+}
+
+function parseIPv4Address(ip: string): number[] | undefined {
+  const parts = ip.split(".");
+
+  if (parts.length !== 4) {
+    return undefined;
+  }
+
+  const octets = parts.map((part) => {
+    if (!/^\d+$/.test(part)) {
+      return Number.NaN;
+    }
+
+    return Number(part);
+  });
+
+  if (octets.some((octet) => !Number.isInteger(octet) || octet < 0 || octet > 255)) {
+    return undefined;
+  }
+
+  return octets;
+}
+
+/**
+ * Helper function to check if an IPv4 address is in a non-public range.
+ */
+function isUnsafeIPv4Address([a, b, c, d]: number[]): boolean {
   return (
-    a === 10 || a === 127 || (a === 172 && b >= 16 && b <= 31) || (a === 192 && b === 168) || (a === 169 && b === 254) // Link-local
+    a === 0 ||
+    a === 10 ||
+    a === 127 ||
+    (a === 100 && b >= 64 && b <= 127) ||
+    (a === 169 && b === 254) ||
+    (a === 172 && b >= 16 && b <= 31) ||
+    (a === 192 && b === 0 && c === 0) ||
+    (a === 192 && b === 168) ||
+    (a === 198 && (b === 18 || b === 19)) ||
+    a >= 224 ||
+    (a === 255 && b === 255 && c === 255 && d === 255)
   );
 }
 
+function parseIPv6Address(ip: string): number[] | undefined {
+  if (!ip.includes(":")) {
+    return undefined;
+  }
+
+  let normalizedIP = ip;
+  const lastSeparator = normalizedIP.lastIndexOf(":");
+  const possibleIPv4 = normalizedIP.slice(lastSeparator + 1);
+
+  if (possibleIPv4.includes(".")) {
+    const ipv4 = parseIPv4Address(possibleIPv4);
+
+    if (!ipv4) {
+      return undefined;
+    }
+
+    const firstGroup = ipv4[0] * 256 + ipv4[1];
+    const secondGroup = ipv4[2] * 256 + ipv4[3];
+    normalizedIP = `${normalizedIP.slice(0, lastSeparator + 1)}${firstGroup.toString(16)}:${secondGroup.toString(16)}`;
+  }
+
+  const halves = normalizedIP.split("::");
+
+  if (halves.length > 2) {
+    return undefined;
+  }
+
+  const head = parseIPv6Groups(halves[0]);
+  const tail = halves.length === 2 ? parseIPv6Groups(halves[1]) : [];
+
+  if (!head || !tail) {
+    return undefined;
+  }
+
+  if (halves.length === 1) {
+    return head.length === 8 ? head : undefined;
+  }
+
+  const missingGroups = 8 - head.length - tail.length;
+
+  if (missingGroups < 1) {
+    return undefined;
+  }
+
+  return [...head, ...Array<number>(missingGroups).fill(0), ...tail];
+}
+
+function parseIPv6Groups(groups: string): number[] | undefined {
+  if (!groups) {
+    return [];
+  }
+
+  const parsedGroups = groups.split(":").map((group) => {
+    if (!/^[\da-f]{1,4}$/i.test(group)) {
+      return Number.NaN;
+    }
+
+    return Number.parseInt(group, 16);
+  });
+
+  if (parsedGroups.some((group) => !Number.isInteger(group) || group < 0 || group > 0xffff)) {
+    return undefined;
+  }
+
+  return parsedGroups;
+}
+
+/**
+ * Helper function to check if an IPv6 address is in a non-public range.
+ */
+function isUnsafeIPv6Address(groups: number[]): boolean {
+  if (groups.length !== 8) {
+    return false;
+  }
+
+  const isUnspecified = groups.every((group) => group === 0);
+  const isLoopback = groups.slice(0, 7).every((group) => group === 0) && groups[7] === 1;
+  const isUniqueLocal = (groups[0] & 0xfe00) === 0xfc00;
+  const isLinkLocal = (groups[0] & 0xffc0) === 0xfe80;
+  const isMulticast = (groups[0] & 0xff00) === 0xff00;
+
+  if (isUnspecified || isLoopback || isUniqueLocal || isLinkLocal || isMulticast) {
+    return true;
+  }
+
+  const mappedIPv4 = getMappedIPv4Address(groups);
+
+  return mappedIPv4 ? isUnsafeIPv4Address(mappedIPv4) : false;
+}
+
+function getMappedIPv4Address(groups: number[]): number[] | undefined {
+  const firstFiveGroupsAreZero = groups.slice(0, 5).every((group) => group === 0);
+  const firstSixGroupsAreZero = firstFiveGroupsAreZero && groups[5] === 0;
+  const isIPv4Mapped = firstFiveGroupsAreZero && groups[5] === 0xffff;
+
+  if (!firstSixGroupsAreZero && !isIPv4Mapped) {
+    return undefined;
+  }
+
+  return [Math.floor(groups[6] / 256), groups[6] % 256, Math.floor(groups[7] / 256), groups[7] % 256];
+}
+
+function containsUnsafeHostname(value: string): boolean {
+  const candidates = value
+    .split(/[\s/?#]+/)
+    .map((candidate) => candidate.replace(/^[a-z][\d+.a-z-]*:\/\//i, "").replace(/:\d+$/, ""))
+    .filter(Boolean);
+
+  return candidates.some((candidate) => isUnsafeHostname(candidate));
+}
+
 /**
  * Helper function to check if a port is typically used for internal services
  */

package/package.json

@@ -1,20 +1,20 @@
 {
   "name": "@apidevtools/json-schema-ref-parser",
-  "version": "15.3.5",
+  "version": "15.4.0",
   "description": "Parse, Resolve, and Dereference JSON Schema $ref pointers",
   "type": "module",
   "types": "dist/lib/index.d.ts",
   "module": "dist/lib/index.js",
   "main": "dist/lib/index.js",
   "scripts": {
-    "prepublishOnly": "yarn build",
+    "prepublishOnly": "pnpm build",
     "lint": "eslint lib",
     "build": "rimraf dist && tsc",
     "typecheck": "tsc --noEmit",
     "prettier": "prettier --write \"**/*.+(js|jsx|ts|tsx|har||json|css|md)\"",
     "test": "vitest --coverage",
     "test:specific": "vitest invalid",
-    "test:node": "yarn test",
+    "test:node": "pnpm test",
     "test:browser": "node ./test/fixtures/run-browser-tests.mjs",
     "test:update": "vitest -u",
     "test:watch": "vitest -w"
@@ -72,32 +72,32 @@
     "@types/json-schema": "^7.0.15"
   },
   "dependencies": {
-    "js-yaml": "^4.1.1"
+    "js-yaml": "^4.2.0"
   },
   "devDependencies": {
-    "@eslint/compat": "^2.0.3",
+    "@eslint/compat": "^2.1.0",
     "@eslint/js": "^10.0.1",
     "@types/eslint": "^9.6.1",
     "@types/js-yaml": "^4.0.9",
     "@types/json-schema": "^7.0.15",
-    "@types/node": "^25",
-    "@typescript-eslint/eslint-plugin": "^8.57.2",
-    "@typescript-eslint/parser": "^8.57.2",
-    "@vitest/coverage-v8": "^4.1.2",
+    "@types/node": "^25.9.3",
+    "@typescript-eslint/eslint-plugin": "^8.61.0",
+    "@typescript-eslint/parser": "^8.61.0",
+    "@vitest/coverage-v8": "^4.1.8",
     "cross-env": "^10.1.0",
-    "eslint": "^10.1.0",
+    "eslint": "^10.4.1",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-import": "^2.32.0",
-    "eslint-plugin-prettier": "^5.5.5",
-    "eslint-plugin-promise": "^7.2.1",
+    "eslint-plugin-prettier": "^5.5.6",
+    "eslint-plugin-promise": "^7.3.0",
     "eslint-plugin-unused-imports": "^4.4.1",
-    "globals": "^17.4.0",
-    "jsdom": "^29.0.1",
-    "prettier": "^3.8.1",
+    "globals": "^17.6.0",
+    "jsdom": "^29.1.1",
+    "prettier": "^3.8.4",
     "rimraf": "^6.1.3",
-    "typescript": "^6.0.2",
-    "typescript-eslint": "^8.57.2",
-    "vitest": "^4.1.2"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "^8.61.0",
+    "vitest": "^4.1.8"
   },
   "release": {
     "branches": [
@@ -110,5 +110,5 @@
       "@semantic-release/github"
     ]
   },
-  "packageManager": "yarn@4.13.0"
+  "packageManager": "pnpm@11.5.3"
 }