You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix: replace java-json-tools to fix security issues - #2416
Please fill out the following checklist to help us review your PR efficiently.
Description
This pull request modernizes the swagger-compat-spec-parser module by removing legacy dependencies and updating code to use standard Jackson APIs and internal utilities. The changes primarily focus on replacing the deprecated com.github.fge JSON libraries with Jackson's standard classes, simplifying the codebase and improving maintainability. Additionally, a new documentation file, CLAUDE.md, has been added to provide comprehensive guidance for contributors and maintainers.
Dependency and Code Modernization:
Replaced the com.github.java-json-tools:json-schema-validator and related com.github.fge libraries with com.networknt:json-schema-validator and removed unused dependencies such as rhino and json-patch in pom.xml.
Updated all usages of com.github.fge.jackson.jsonpointer.JsonPointer to use Jackson's com.fasterxml.jackson.core.JsonPointer and updated code to use the .compile() method for pointer creation.
Replaced JacksonUtils.newMapper() with JacksonSupport.newMapper() for object mapper instantiation throughout the migrator and utility classes, and removed imports of unused or deleted classes.
Updated resource loading from JsonLoader.fromResource to JacksonSupport.fromResource and removed exception handling for JsonPatchException where no longer needed, simplifying patch application logic.
Documentation:
Added a new CLAUDE.md file with detailed build, test, branching, architecture, and release process instructions to help contributors and maintainers understand and work with the codebase.
Type of Change
🐛 Bug fix
✨ New feature
♻️ Refactor (non-breaking change)
🧪 Tests
📝 Documentation
🧹 Chore (build or tooling)
Checklist
I have added/updated tests as needed
I have added/updated documentation where applicable
The reason will be displayed to describe this comment to others. Learn more.
🟡 Changes recommended
The JSON patch assertions can pass despite incorrect object member names because TestNG compares JsonNode values as iterables, and the guide includes module commands that fail in this checkout.
This PR replaces legacy java-json-tools dependencies in the Swagger compatibility parser with NetworkNT validation, standard Jackson APIs, and internal utilities to address security concerns.
Changes:
Replaces schema validation, JSON Pointer handling, and JSON Patch dependencies.
Adds patch and validation tests, updates existing tests, and adds reference fixtures.
Adds contributor documentation covering builds and architecture.
Jackson's JsonPointer.compile() checks the leading slash but deliberately preserves malformed escapes. As a result, a patch with path: "/a~2b" or path: "/a~" is accepted and modifies that literal member instead of rejecting an invalid RFC 6901 pointer. Please validate that every ~ is followed by 0 or 1 before compiling; validating here covers both path and from.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Pull Request
Thank you for contributing to swagger-parser!
Please fill out the following checklist to help us review your PR efficiently.
Description
This pull request modernizes the
swagger-compat-spec-parsermodule by removing legacy dependencies and updating code to use standard Jackson APIs and internal utilities. The changes primarily focus on replacing the deprecatedcom.github.fgeJSON libraries with Jackson's standard classes, simplifying the codebase and improving maintainability. Additionally, a new documentation file,CLAUDE.md, has been added to provide comprehensive guidance for contributors and maintainers.Dependency and Code Modernization:
com.github.java-json-tools:json-schema-validatorand relatedcom.github.fgelibraries withcom.networknt:json-schema-validatorand removed unused dependencies such asrhinoandjson-patchinpom.xml.com.github.fge.jackson.jsonpointer.JsonPointerto use Jackson'scom.fasterxml.jackson.core.JsonPointerand updated code to use the.compile()method for pointer creation.JacksonUtils.newMapper()withJacksonSupport.newMapper()for object mapper instantiation throughout the migrator and utility classes, and removed imports of unused or deleted classes.JsonLoader.fromResourcetoJacksonSupport.fromResourceand removed exception handling forJsonPatchExceptionwhere no longer needed, simplifying patch application logic.Documentation:
CLAUDE.mdfile with detailed build, test, branching, architecture, and release process instructions to help contributors and maintainers understand and work with the codebase.Type of Change
Checklist
Screenshots / Additional Context