v8.6.6 uses vulnerable version of oas package

[xfated]

Issue:
The current stable release of rdme (8.6.6) is using an outdated version of the 'oas' package, which in turn depends on a vulnerable version of 'jsonpath-plus'.

Details:

• rdme version: 8.6.6
• oas version: ^20.10.2
• jsonpath-plus version: 7.2.0

The vulnerability in jsonpath-plus versions before 10.0.0 is related to Remote Code Execution (RCE) due to improper input sanitization. More information can be found here: https://security.snyk.io/vuln/SNYK-JS-JSONPATHPLUS-7945884

Request:
Could you please update the 'oas' dependency in rdme to use a version that includes the patched version of jsonpath-plus (10.0.0 or later)?

Impact:
This vulnerability potentially exposes projects using rdme to security risks, especially if they're processing untrusted input.

Additional Notes:

• I noticed that there's a pre-release version (9.0.0-next.18) available
• Is there a timeline for when a new stable version of rdme with updated dependencies will be released?