Ajv 6

Apply the JavaScript ES2026 baseline first. These rules cover the Ajv 6 legacy line, checked against 6.15.0, including its schema compiler, permissive defaults, built-in formats, data mutation, remote references, extensions, generated code, and error handling.

Version, runtime, and dialect boundary

• Take Ajv 6 fixes from the newest 6.x release. Ajv has shipped its 6.x security backports as new minor releases rather than as patches to older minors, so a tilde range, or a lockfile entry held on an older 6.x minor, never receives them. Many tools still pull in Ajv 6 transitively, so check every resolved copy with npm ls ajv and raise old ones with npm update ajv, or with an overrides entry scoped to the packages that still need Ajv 6 so it doesn't also rewrite Ajv 8 copies elsewhere in the tree.
• Treat Ajv 6 as a legacy compatibility dependency and maintain a tested migration plan to the current major line; do not add new Ajv 6 usage when Ajv 8 can satisfy the schema contract.
• Run Ajv only on a currently supported JavaScript runtime. Ajv 6.15.0 declares no engines constraint and its tagged documentation only claims Node.js through 14.x, so package installation success is not proof of runtime support or security.
• Select the schema dialect deliberately: use the default schemaId: "$id" for draft-06/07, register ajv/lib/refs/json-schema-draft-06.json with addMetaSchema for draft-06, and add the exact trusted meta-schema plus schemaId: "id" or "auto" only when draft-04 compatibility is required. Never let request data select the dialect or meta-schema.