chore(deps): update dependency ajv to 6.12.3 [security]

[renovate]

This PR contains the following updates:

Package	Change
ajv	5.5.2 -> 6.12.3
ajv	4.11.8 -> 6.12.3

GitHub Vulnerability Alerts

CVE-2020-15366

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[confused-Techie]

All tests are failing exactly how we would expect, most importantly in autocomplete-plus.

Both in dalek and settings-view this just changes the package-lock.json meaning the most recent builds of Pulsar likely already come with this version.

Whereas autocomplete-plus has the only package.json change. But all tests are passing there exactly as we'd expect, so unless anyone has any concerns we should absolutely merge this to resolve the security vulnerability.

[confused-Techie]

With all tests passing, and the impact of this dep bump seemingly being very low, I'll go ahead and merge this one, as it is a security issue. But as always we can keep an eye on any issues that may arise.