Dependency update: cms-tina example pulls vulnerable jsonpath-plus (C…

[i5d6]

Summary

The examples/cms-tina project depends on a vulnerable version of jsonpath-plus affected by CVE-2024-21534 (Critical RCE).
This dependency is introduced transitively through @tinacms/cli@^0.60.16.

---

Affected Location

• examples/cms-tina/package.json

"dependencies": {
  "@tinacms/cli": "^0.60.16"
}

[nextjs-bot]

Allow CI Workflow Run

• approve CI run for commit: acf1b45

Note: this should only be enabled once the PR is ready to go and can only be enabled by a maintainer

[vercel]

Malformed package name "@JSONPath-Plus@" and missing @tinacms/cli dependency breaks tinacms CLI scripts

[i5d6]

Malformed package name "https://github.com/JSONPath-Plus@" and missing @tinacms/cli dependency breaks tinacms CLI scripts

Observed Behavior

During dependency installation and script execution, the TinaCMS CLI pulls an outdated transitive dependency chain that resolves [email protected].

• This dependency:

• Is affected by CVE-2024-21534 (Critical RCE)

• Causes unexpected behavior during package resolution

Results in malformed package name references such as @JSONPath-Plus@ during CLI execution or dependency resolution