[Question]: Guidance on jackson-coreutils vulnerabilities in legacy Swagger compatibility dependency
Nadie ha tomado este issue todavía.
Evaluación
- Dificultad
- 5/5
- Tiempo estimado
- Más de una semana
- Aptitud para principiantes
- 8/100
- Tipo de issue
- Refactorización
- Claridad
- Necesita aclaración
- Estado de actividad
- Activo
- Stack tecnológico
- java
- Área
- build-system, security
Línea de trabajo
The problem is the transitive chain swagger-parser-v2-converter → swagger-compat-spec-parser:1.0.71 → json-schema-validator / json-patch → jackson-coreutils:2.0, which is needed only for the Swagger 1.2 path (NoClassDefFoundError on com.github.fge.jackson.jsonpointer.JsonPointer). Done would need a maintainer decision on whether to keep, replace or drop Swagger 1.2 support, so this is not a starting point for a first contribution.
Escrito por el modelo de indexación a partir del texto del issue.
Descripción
We use `io.swagger.parser.v3:swagger-parser:2.1.23` in a Java 8 application.
The application must currently retain support for parsing legacy Swagger 1.2 documents, in addition to Swagger 2.0 and OpenAPI 3 documents.
Our resolved dependency tree shows that Swagger 1.2 compatibility is provided through the legacy `swagger-compat-spec-parser` module:
io.swagger.parser.v3:swagger-parser:2.1.23
└── io.swagger.parser.v3:swagger-parser-v2-converter:2.1.23
├── io.swagger:swagger-parser:1.0.71
└── io.swagger:swagger-compat-spec-parser:1.0.71
├── com.github.java-json-tools:json-schema-validator:2.2.14
│ └── com.github.java-json-tools:json-schema-core:1.2.14
│ └── com.github.java-json-tools:jackson-coreutils:2.0
└── com.github.java-json-tools:json-patch:1.13
└── com.github.java-json-tools:jackson-coreutils:2.0
`jackson-coreutils:2.0` is currently being reported for:
- CVE-2026-86513
- CVE-2026-86511
- CVE-2026-86321
Is there a supported release, replacement dependency, or recommended remediation that removes or patches `jackson-coreutils:2.0` while retaining:
- Swagger 1.2 conversion
- Java 8 compatibility
- Swagger 2.0 and OpenAPI 3 parsing
We understand that Swagger Parser 2.x does not document native support for Swagger 1.2. In our case, that behavior is coming from the transitive `swagger-compat-spec-parser:1.0.71` module.
We would prefer an upstream-supported solution rather than maintaining a private fork.
## Affected Version
`io.swagger.parser.v3:swagger-parser:2.1.23`
Runtime: Java 8
## Context
We tested the following configurations:
1. With all dependencies present:
- Swagger 1.2 parsing succeeds
- Swagger 2.0 parsing succeeds
- OpenAPI 3 parsing succeeds
2. After removing only `jackson-coreutils`:
- Swagger 2.0 and OpenAPI 3 parsing still succeed
- Swagger 1.2 parsing fails with:
java.lang.NoClassDefFoundError:
com/github/fge/jackson/jsonpointer/JsonPointer
3. After excluding the legacy `swagger-compat-spec-parser` dependency chain:
- Swagger 2.0 and OpenAPI 3 parsing succeed
- Swagger 1.2 is no longer parsed
This indicates that `jackson-coreutils` is required at runtime specifically by the legacy Swagger 1.2 compatibility path.
We would appreciate guidance on the preferred upstream solution:
1. Is `swagger-compat-spec-parser` still maintained, and would a dependency-remediation PR be considered?
2. Is there an existing Java 8-compatible replacement or patched release?
3. Should remediation be proposed in this repository, or directly in the `jackson-coreutils` project?
4. Is removal of Swagger 1.2 support now the only supported migration path?
## Additional Details
Related upstream reports:
- https://github.com/java-json-tools/jackson-coreutils/issues/64
- https://github.com/java-json-tools/jackson-coreutils/issues/65
- https://github.com/java-json-tools/jackson-coreutils/issues/66- Lenguaje dominante
- Java
- Estrellas
- 870
- Forks
- 566
- Métricas de merge de PR
- Sin PR fusionados en 30 d
Preparar el entorno
- Sin Dockerfile ni archivo de Docker Compose
- Tiene una plantilla de pull request
- Leer la guía de contribución
Primeros pasos
- Lee el issue completo y luego la guía de contribución del proyecto.
- Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
- Haz un fork del repositorio y trabaja en una rama.
- Abre un pull request que haga referencia al número del issue.
Más de swagger-api/swagger-parser
-
InlineModelResolver.uniqueName throws StringIndexOutOfBoundsException for titles starting with a separator (camelCaseFlattenNaming)Posiblemente ocupada @arimu1 la tomó hace 59 días. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 78/100
swagger-api/swagger-parser#2386 ·
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
swagger-api/swagger-parser#2168 ·
-
ResolveFully fails on internal references when the initial spec is read from a file URLPosiblemente ocupada Un pull request vinculado a esta issue está abierto o ya se fusionó. Abierto
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
swagger-api/swagger-parser#1922 · 2 comentarios · 1 reacción ·
-
Bug
Dificultad 3/5 1-2 días Aptitud para principiantes 55/100
swagger-api/swagger-parser#2408 ·
-
[Bug]: Discriminator mapping of a oneOf nested in array items gets a null key and is no longer updated after external ref resolution (regression since 2.1.36)Posiblemente ocupada @wyhasany la tomó hace 13 días. Abierto
Dificultad 3/5 1-2 días Aptitud para principiantes 25/100
swagger-api/swagger-parser#2406 · 1 comentario ·
Todos los issues de swagger-api/swagger-parser
Issues similares
-
bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 72/100
apache/rocketmq-dashboard#7361 ·
Los mantenedores suelen responder en 3 días
-
Dificultad 2/5 1-3 horas Aptitud para principiantes 65/100
Los mantenedores suelen responder en 1 día
-
Type/Improvement
Dificultad 2/5 1-3 horas Aptitud para principiantes 68/100
ballerina-platform/static-code-analysis-tool#140 ·
Los mantenedores suelen responder en 1 día
-
bug
Dificultad 2/5 1-3 horas Aptitud para principiantes 76/100
atomityhq/blog-cms#82 · 1 comentario ·
Los mantenedores suelen responder en 1 día
-
ready-for-triage triaged
Dificultad 2/5 1-3 horas Aptitud para principiantes 74/100
RedHatInsights/notifications-backend#5080 · 2 comentarios ·
Los mantenedores suelen responder en 1 día