postman-collection dependency causing vulnerabilities

[niallbroadley]

Context

http-spec currently has postman-collection dependency pinned to "postman-collection": "^4.1.3",. While this could be updated to use the latest version (which is 5.3.1), the issue would still be that postman-collection currently uses very out of date dependencies for two packages (@faker-js/faker, uuid) and the outdated dependencies are linked to CVE-2026-73231 and CVE-2026-41907

There is no possibility to override the faker dependency because it's not compatible with the latest version of postman-collection and it doesn't look like postman-collection have an effective release cadence for resolving these issues (doesn't seem to be any interaction from maintainers etc.)

postmanlabs/postman-collection#1390
postmanlabs/postman-collection#1425

This blocks my organisation from using any package with postman-collection in it's dependency tree which includes @stoplight/http-spec and by extension @stoplight/prism-cli which is what we're truly interested in.

Possible Solution(s)

How deeply tied is http-spec to postman-collection? Is it possible to find an alternative?