Thank you for the clarification. You’re correct that the documentation does not state that Swagger Parser 2.x officially supports Swagger Specification 1.x. Our resolved dependency tree is:
io.swagger.parser.v3:swagger-parser:2.1.23
└── swagger-parser-v2-converter:2.1.23
├── io.swagger:swagger-parser:1.0.71
└── swagger-compat-spec-parser:1.0.71
├── json-schema-validator:2.2.14
│ └── json-schema-core:1.2.14
│ └── jackson-coreutils:2.0
└── json-patch:1.13
└── jackson-coreutils:2.0
Our application also calls the older io.swagger.parser.SwaggerParser API. In an isolated Java 8 test, a Swagger 1.2 document was converted successfully with these dependencies. Removing jackson-coreutils caused the legacy conversion to fail with:
NoClassDefFoundError: com/github/fge/jackson/jsonpointer/JsonPointer
Therefore, our legacy Swagger support comes from the transitive Parser 1.x compatibility components, rather than documented native support in Parser 2.x.
Given that the vulnerable dependency is introduced through swagger-compat-spec-parser:1.0.71, which repository and branch should this be reported against? Should the remediation be made in Swagger Parser’s compatibility module, or does it need to be handled exclusively by the jackson-coreutils project?
I would also appreciate guidance on whether Swagger 1.2 compatibility still has a supported migration path.
