Thanks!

The upgrade looks safe considering the usage:

https://github.com/raml-org/raml-js-parser-2/blob/e7b036b519c8c6cc6ffc0c5ffcf368195181d50e/src/parser/highLevelImpl.ts#L2998

https://github.com/flitbit/json-path/blob/v0.1.3/index.js#L332

The FOLIO security team meets weekly to review all possible security threats. As long as mod-graphql ships with a vulnerable version of json-ptr the security team needs to investigate whether the use of json-ptr is save or if some code change has been made that uses json-ptr in a vulnerable way.

Updating json-ptr saves time the security teams needs for this continous manual investigation.

That's weird: how is ~0.1.1 getting resolved to v2.2.0?

Anyway, I guess this upgrade looks safe enough (though unnecessary), I'll proceed,

mod-graphql currently uses json-ptr 2.2.0.

The release notes https://github.com/flitbit/json-ptr#releases explain that there is only one change from 2.2.0 to 3.0.0: Prototype pollution has been disabled.

https://github.com/flitbit/json-path/blob/master/index.js doesn't need prototype pollution, therefore the pollution should be disabled for security.