Skip to content

deps: bump com.networknt:json-schema-validator from 1.4.3 to 3.0.7 - #89

Closed
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/com.networknt-json-schema-validator-3.0.7
Closed

deps: bump com.networknt:json-schema-validator from 1.4.3 to 3.0.7#89
dependabot[bot] wants to merge 1 commit into
masterfrom
dependabot/maven/com.networknt-json-schema-validator-3.0.7

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 28, 2026

Copy link
Copy Markdown
Contributor

Bumps com.networknt:json-schema-validator from 1.4.3 to 3.0.7.

Release notes

Sourced from com.networknt:json-schema-validator's releases.

3.0.7- 2026-08-20

Added

Changed

3.0.6- 2026-07-07

Added

Changed

3.0.5- 2026-06-21

Added

Changed

  • fixes #1252 problem with additionalProperties schema in jsconfig schema (#1253)
  • fixes #1174 TextNodes as schema seem to validate any value (#1250)

3.0.4- 2026-06-10

Added

Changed

3.0.3- 2026-05-27

Added

Changed

3.0.2- 2026-04-14

Added

... (truncated)

Changelog

Sourced from com.networknt:json-schema-validator's changelog.

Change Log

All notable changes to this project will be documented in this file.

This format is based on Keep a Changelog.

This project does not adhere to Semantic Versioning and minor version changes can have incompatible API changes. These incompatible API changes will largely affect those who have custom validator or walker implementations. Those who just use the library to validate using the standard JSON Schema Draft specifications may not need changes.

[Unreleased]

Added

Changed

  • Resolve the OpenAPI nullable keyword through allOf/oneOf/anyOf, if/then/else and $ref/$dynamicRef/$recursiveRef ancestors, to any depth and in any order. nullable on a schema composed through these keywords now applies to the value they describe, for both the type and enum keywords.
  • nullable on a container no longer applies to the values described by its properties, items and additionalProperties subschemas. Previously a nullable container made its children accept null. Schemas relying on that must declare nullable on the child itself.
  • oneOf no longer requires exactly one matching branch when the value is null and a nullable ancestor permits it. Every branch accepts null in that case, so {"nullable": true, "oneOf": [ ... ]} previously reported that more than one branch matched. Branch errors are still reported when no branch matches.
  • nullable no longer applies inside a not subschema, so {"nullable": true, "not": {"type": "string"}} now accepts null where it previously reported a not error.
  • With typeLoose enabled, the empty string no longer satisfies an enum on a nullable schema. null was previously held in the accepted set and compared as text, where it renders as the empty string, so {"enum": ["a"], "nullable": true} accepted "". Only an actual null is accepted now.
  • A nullable declared alongside $ref is now ignored at the root of an OpenAPI 3.0 schema as it already was elsewhere, so {"$ref": "...", "nullable": true} rejects null. Siblings of a Reference Object are ignored in OpenAPI 3.0.

3.0.7- 2026-08-20

Added

Changed

3.0.6- 2026-07-07

Added

Changed

3.0.5- 2026-06-21

Added

Changed

  • fixes #1252 problem with additionalProperties schema in jsconfig schema (#1253)

... (truncated)

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
deps: bump com.networknt:json-schema-validator from 1.4.3 to 3.0.7
8e15fe3 
Bumps [com.networknt:json-schema-validator](https://github.com/networknt/json-schema-validator) from 1.4.3 to 3.0.7.
- [Release notes](https://github.com/networknt/json-schema-validator/releases)
- [Changelog](https://github.com/networknt/json-schema-validator/blob/master/CHANGELOG.md)
- [Commits](networknt/json-schema-validator@1.4.3...3.0.7)

---
updated-dependencies:
- dependency-name: com.networknt:json-schema-validator
  dependency-version: 3.0.7
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added the dependencies Dependency version bumps label Sep 28, 2026
This was referenced Sep 29, 2026
Closed
Merged
@shossain786

shossain786 commented Sep 30, 2026

Copy link
Copy Markdown
Contributor

Closing in favor of #95. This bump targets the wrong artifact — json-schema-validator's transitive jackson version is overridden by our own direct pin anyway, so it never touched the actually-vulnerable dependency. It also doesn't compile: 3.0.7 rewrote the JsonSchemaFactory/ValidationMessage API onto a separate Jackson 3.x (tools.jackson) line. #95 fixes both CVEs directly by bumping our own jackson-databind pin to 2.21.7.

@dependabot @github

dependabot Bot commented on behalf of github Sep 30, 2026

Copy link
Copy Markdown
Contributor Author

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot
dependabot Bot deleted the dependabot/maven/com.networknt-json-schema-validator-3.0.7 branch September 30, 2026 05:10
shossain786 added a commit that referenced this pull request Sep 30, 2026
@shossain786 @claude
fix(deps): bump jackson-databind to 2.21.7 to fix CVE-2026-54512/54513 (
65b89ee 
#95)

Our own direct pin (2.21.0) falls in the vulnerable range (>=2.19.0,
<2.21.4) for both CVEs — a PolymorphicTypeValidator bypass allowing
arbitrary class instantiation during deserialization. Fixed upstream
in 2.21.4; bumped to the latest 2.21.x patch (2.21.7).

Dependabot's PR #89 targeted json-schema-validator 1.4.3 -> 3.0.7
instead, but that dependency is optional and its transitive jackson
version is overridden by our direct pin anyway (Maven dependency
mediation), so bumping it doesn't touch the actually-vulnerable
artifact. It also doesn't build: 3.0.7 replaced the whole
JsonSchemaFactory/ValidationMessage API with a jackson 3.x
(tools.jackson) rewrite, which would pull in a second, incompatible
Jackson major version. Bumping our own jackson-databind pin fixes
the CVEs directly without any of that.

547 tests green.

Closes #94.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Dependency version bumps

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@shossain786