ajv-validator/ajv: 3 upstream defects

Each entry is a real fix from the project's own history. Apply its patch and run the project's own suite, and the tests written in that same upstream commit fall.

the suite it was checked against

language	tests	green run, s	flaky runs	test files locked
node	7,962	23.97	2/11	75

One of the pinned external suites the repair arbiter was run against, as listed on the benchmarks page (fixed values in site/build.py).

the defects

compileAsync a schema with discriminator and $ref, fixes #2427 (#2433)

5 source line(s), 1 test(s) fall, deterministic over three runs. upstream fix 5f20d5f90adc. the test that catches it was written by the same engineer in the same commit and was never touched.

file lib/vocabularies/discriminator/index.ts · status reported · 2026-08-01

git apply bench/evidence/2026-08-01-real-defect-mine/patches/ajv-discriminator-compileasync-ref.patch && <the project's own suite>

test/fix prototype pollution via $data ref with format keyword (#2607)

1 source line(s), 2 test(s) fall, deterministic over three runs. upstream fix e8d2bdc501b3. the test that catches it was written by the same engineer in the same commit and was never touched.

file lib/core.ts · status reported · 2026-08-01

git apply bench/evidence/2026-08-01-real-defect-mine/patches/ajv-format-proto-pollution.patch && <the project's own suite>

fix(pattern): use configured RegExp engine with $data keyword to mitigate ReDoS attacks (CVE-2025-69873) (#2586)

19 source line(s), 4 test(s) fall, deterministic over three runs. upstream fix 720a23fa453f. the test that catches it was written by the same engineer in the same commit and was never touched.

file lib/vocabularies/validation/pattern.ts · status reported · 2026-08-01

git apply bench/evidence/2026-08-01-real-defect-mine/patches/ajv-pattern-redos-cve-2025-69873.patch && <the project's own suite>