[Question]: Guidance on jackson-coreutils vulnerabilities in legacy Swagger compatibility dependency
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 8/100
- Issue 类型
- 重构
- 描述清晰度
- 需要澄清
- 活跃度
- 活跃
- 技术栈
- java
- 领域
- build-system, security
调研方向
The problem is the transitive chain swagger-parser-v2-converter → swagger-compat-spec-parser:1.0.71 → json-schema-validator / json-patch → jackson-coreutils:2.0, which is needed only for the Swagger 1.2 path (NoClassDefFoundError on com.github.fge.jackson.jsonpointer.JsonPointer). Done would need a maintainer decision on whether to keep, replace or drop Swagger 1.2 support, so this is not a starting point for a first contribution.
由索引模型根据 Issue 内容生成。
描述
We use `io.swagger.parser.v3:swagger-parser:2.1.23` in a Java 8 application.
The application must currently retain support for parsing legacy Swagger 1.2 documents, in addition to Swagger 2.0 and OpenAPI 3 documents.
Our resolved dependency tree shows that Swagger 1.2 compatibility is provided through the legacy `swagger-compat-spec-parser` module:
io.swagger.parser.v3:swagger-parser:2.1.23
└── io.swagger.parser.v3:swagger-parser-v2-converter:2.1.23
├── io.swagger:swagger-parser:1.0.71
└── io.swagger:swagger-compat-spec-parser:1.0.71
├── com.github.java-json-tools:json-schema-validator:2.2.14
│ └── com.github.java-json-tools:json-schema-core:1.2.14
│ └── com.github.java-json-tools:jackson-coreutils:2.0
└── com.github.java-json-tools:json-patch:1.13
└── com.github.java-json-tools:jackson-coreutils:2.0
`jackson-coreutils:2.0` is currently being reported for:
- CVE-2026-86513
- CVE-2026-86511
- CVE-2026-86321
Is there a supported release, replacement dependency, or recommended remediation that removes or patches `jackson-coreutils:2.0` while retaining:
- Swagger 1.2 conversion
- Java 8 compatibility
- Swagger 2.0 and OpenAPI 3 parsing
We understand that Swagger Parser 2.x does not document native support for Swagger 1.2. In our case, that behavior is coming from the transitive `swagger-compat-spec-parser:1.0.71` module.
We would prefer an upstream-supported solution rather than maintaining a private fork.
## Affected Version
`io.swagger.parser.v3:swagger-parser:2.1.23`
Runtime: Java 8
## Context
We tested the following configurations:
1. With all dependencies present:
- Swagger 1.2 parsing succeeds
- Swagger 2.0 parsing succeeds
- OpenAPI 3 parsing succeeds
2. After removing only `jackson-coreutils`:
- Swagger 2.0 and OpenAPI 3 parsing still succeed
- Swagger 1.2 parsing fails with:
java.lang.NoClassDefFoundError:
com/github/fge/jackson/jsonpointer/JsonPointer
3. After excluding the legacy `swagger-compat-spec-parser` dependency chain:
- Swagger 2.0 and OpenAPI 3 parsing succeed
- Swagger 1.2 is no longer parsed
This indicates that `jackson-coreutils` is required at runtime specifically by the legacy Swagger 1.2 compatibility path.
We would appreciate guidance on the preferred upstream solution:
1. Is `swagger-compat-spec-parser` still maintained, and would a dependency-remediation PR be considered?
2. Is there an existing Java 8-compatible replacement or patched release?
3. Should remediation be proposed in this repository, or directly in the `jackson-coreutils` project?
4. Is removal of Swagger 1.2 support now the only supported migration path?
## Additional Details
Related upstream reports:
- https://github.com/java-json-tools/jackson-coreutils/issues/64
- https://github.com/java-json-tools/jackson-coreutils/issues/65
- https://github.com/java-json-tools/jackson-coreutils/issues/66- 主要语言
- Java
- 星标
- 870
- 派生
- 566
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
swagger-api/swagger-parser 的其他 Issue
-
InlineModelResolver.uniqueName throws StringIndexOutOfBoundsException for titles starting with a separator (camelCaseFlattenNaming)可能已有人在做 @arimu1 于 61 天前认领。 未关闭
难度 2/5 1-3 小时 新手友好度 78/100
swagger-api/swagger-parser#2386 ·
-
难度 2/5 1-3 小时 新手友好度 72/100
swagger-api/swagger-parser#2168 ·
-
ResolveFully fails on internal references when the initial spec is read from a file URL可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭
难度 2/5 1-3 小时 新手友好度 65/100
swagger-api/swagger-parser#1922 · 2 条评论 · 1 个 reaction ·
-
[Bug]: Array `items` `$ref` to an external file is not resolved to `#/components/schemas/...` when it's the only `$ref` in the referencing file可能已有人在做 关联的 PR 仍在进行中或已合并。 未关闭Bug
难度 3/5 1-2 天 新手友好度 74/100
swagger-api/swagger-parser#2409 ·
-
Bug
难度 3/5 1-2 天 新手友好度 55/100
swagger-api/swagger-parser#2408 ·
查看 swagger-api/swagger-parser 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 76/100
oracle/graalvm-reachability-metadata#11472 ·
维护者通常 1 天内回复
-
status: waiting-for-triage
难度 2/5 1-3 小时 新手友好度 70/100
spring-projects/spring-ai#7269 ·
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 89/100
objectionary/hone-maven-plugin#1353 ·
维护者通常 9 天内回复
-
ClassNotFoundException: io.netty.channel.kqueue.KQueueEventLoop stack trace printed during native build on main (Netty 4.2 removed the class)可能已有人在做 @gastaldi 今天认领。 未关闭area/netty kind/bug
难度 2/5 1-3 小时 新手友好度 68/100
quarkusio/quarkus#57939 · 1 条评论 ·
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 78/100
conductor-oss/conductor#1777 ·
维护者通常 4 天内回复