jsonpath-plus is restricted to 10.2.0 which is vulnerable to CVE-2025-1302

[mriedem]

Describe the bug
jsonpath-plus is restricted to 10.2.0:

https://github.com/stoplightio/spectral/blob/%40stoplight/spectral-core-1.19.4/packages/core/package.json#L50

https://github.com/stoplightio/spectral/blob/%40stoplight/spectral-core-1.19.4/yarn.lock#L9284

So it's vulnerable to GHSA-hw8r-x6gr-5gjp.

To Reproduce

Interestingly npm audit isn't flagging this yet.

Expected behavior

Shouldn't have vulnerable dependencies; upgrade to jsonpath-plus 10.3.0.

Additional context
https://github.com/JSONPath-Plus/JSONPath/releases/tag/v10.3.0

Fix: JSONPath-Plus/JSONPath#237

[mriedem]

PR #2785 is trying to bump the package version which includes the fix (#2780).