> The traditional path would be remediating the vulns at source, with a contribution to jackson-coreutils, which consuming libraries such as swagger-compat-spec-parser can pull in via a corresponding pull request targeting the v1 branch.
Okay, thanks for the clarification, will look into this.
Our use case is an enterprise product with customers running long-lived legacy integrations. The provider onboarding functionality allows customers to import a Swagger definition from a supplied URL.
We do not actively recommend or develop against Swagger 1.x, but because the compatibility parser is currently included transitively, existing customers may be relying on it. At this point, we cannot safely confirm that no customer imports Swagger 1.x definitions.
If Swagger 1.2 must remain supported, we understand that the appropriate upstream path is to remediate jackson-coreutils first and then update the dependency in the Swagger Parser v1 branch.
Thanks for your help.
