Snyk high security vulnerability in `json-ref-resolver` dependency

[rmkeezer]

For support questions, please use the Stoplight Discord Community. This repository's issues are reserved for feature requests and bug reports. If you are unsure if you are experiencing a bug, our Discord is a great place to start.

Please delete this section, any any sections below that you don't use, before creating the issue.

Describe the bug I am running into Snyk security vulnerability on the json-ref-resolver dependency because it is using an outdated dependency lodash.set which has an unresolved prototype pollution vulnerability. It should instead use set from the lodash dependency.

To Reproduce See: https://security.snyk.io/vuln/SNYK-JS-LODASHSET-1320032

Additional context I opened a PR here and I'm opening this issue for visibility

[dpopp07]

@P0lip Any outlook on this vulnerability being addressed?

[P0lip]

Ooops, my apologies, I missed this one. I see @rmkeezer was kind enough to create PRs, so all that's left for me is to review them. I'll make sure to do it by the end of the week. Once again, my apologies for dropping a ball on this one.

[P0lip]

Update the dep in https://github.com/stoplightio/spectral/commit/dc97f2414caaaae4c64166122f078c2de9d81ac2. @stoplight/[email protected] should be out in a few minutes