From 4f7e6a5940122bda6c102671e69736ac0f9933bd Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Wed, 22 Jul 2026 22:21:31 +0000 Subject: [PATCH 1/3] chore(deps): Bump com.networknt:json-schema-validator Bumps [com.networknt:json-schema-validator](https://github.com/networknt/json-schema-validator) from 1.5.9 to 3.0.6. - [Release notes](https://github.com/networknt/json-schema-validator/releases) - [Changelog](https://github.com/networknt/json-schema-validator/blob/master/CHANGELOG.md) - [Commits](https://github.com/networknt/json-schema-validator/compare/1.5.9...3.0.6) --- updated-dependencies: - dependency-name: com.networknt:json-schema-validator dependency-version: 3.0.6 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index cd4850c..7d5f9aa 100644 --- a/pom.xml +++ b/pom.xml @@ -52,7 +52,7 @@ its JUnit Jupiter version to whatever the Quarkus BOM ships. --> 3.37.3 0.9.2 - 1.5.9 + 3.0.6 From 27c32b5b5de44c3ca97c774576bd0614afc187fc Mon Sep 17 00:00:00 2001 From: cuioss oliver <23139298+cuioss@users.noreply.github.com> Date: Thu, 23 Jul 2026 07:54:58 +0200 Subject: [PATCH 2/3] fix(config): migrate ConfigLoader to json-schema-validator 3.0.6 API The 1.5.9 -> 3.0.6 major bump renamed the whole public API and moved its node surface to Jackson 3 (tools.jackson): JsonSchema -> Schema JsonSchemaFactory -> SchemaRegistry (getInstance -> withDefaultDialect) SpecVersion.V202012 -> SpecificationVersion.DRAFT_2020_12 ValidationMessage -> Error (validate now returns List) ConfigLoader is built on Jackson 2 (com.fasterxml.jackson) and the rest of the app stays on Jackson 2. Rather than pull Jackson 3 into this code, bridge the already-parsed Jackson 2 tree to the validator through a JSON string and let the validator re-parse it with its own mapper via validate(String, InputFormat.JSON). Error.getInstanceLocation()/getMessage() keep the same ConfigError mapping. All 714 api-sheriff tests and verify -Ppre-commit pass. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01PpXbDJSEs9wAns2MftaBm7 --- .../gateway/config/load/ConfigLoader.java | 42 ++++++++++++------- 1 file changed, 27 insertions(+), 15 deletions(-) diff --git a/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java b/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java index aba44bc..668bd60 100644 --- a/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java +++ b/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java @@ -26,7 +26,6 @@ import java.util.Iterator; import java.util.List; import java.util.Objects; -import java.util.Set; import java.util.function.Consumer; import java.util.regex.Pattern; import java.util.stream.Stream; @@ -37,6 +36,7 @@ import de.cuioss.sheriff.gateway.config.model.UpstreamDefaultsConfig; import com.fasterxml.jackson.core.JsonParser; +import com.fasterxml.jackson.core.JsonProcessingException; import com.fasterxml.jackson.core.StreamReadConstraints; import com.fasterxml.jackson.databind.DeserializationContext; import com.fasterxml.jackson.databind.JsonDeserializer; @@ -55,10 +55,11 @@ import com.fasterxml.jackson.dataformat.yaml.YAMLFactory; import com.fasterxml.jackson.dataformat.yaml.YAMLMapper; import com.fasterxml.jackson.datatype.jdk8.Jdk8Module; -import com.networknt.schema.JsonSchema; -import com.networknt.schema.JsonSchemaFactory; -import com.networknt.schema.SpecVersion; -import com.networknt.schema.ValidationMessage; +import com.networknt.schema.Error; +import com.networknt.schema.InputFormat; +import com.networknt.schema.Schema; +import com.networknt.schema.SchemaRegistry; +import com.networknt.schema.SpecificationVersion; import org.jspecify.annotations.Nullable; import org.yaml.snakeyaml.LoaderOptions; import org.yaml.snakeyaml.Yaml; @@ -106,12 +107,14 @@ public final class ConfigLoader { private static final Pattern INTEGER = Pattern.compile("-?\\d+"); private static final List SECRET_POINTERS = List.of( "/oidc/client_secret", "/oidc/session/encryption_key", "/oidc/session/previous_key"); + /** Plain JSON writer used only to bridge a parsed Jackson 2 tree to the schema validator's string API. */ + private static final ObjectMapper JSON_WRITER = new ObjectMapper(); private final Path configDir; private final EnvSecretResolver secretResolver; private final ObjectMapper mapper; - private final JsonSchema gatewaySchema; - private final JsonSchema endpointSchema; + private final Schema gatewaySchema; + private final Schema endpointSchema; /** * Creates a loader for the given configuration directory. @@ -125,9 +128,9 @@ public ConfigLoader(Path configDir, EnvSecretResolver secretResolver) { this.configDir = Objects.requireNonNull(configDir, "configDir"); this.secretResolver = Objects.requireNonNull(secretResolver, "secretResolver"); this.mapper = buildMapper(); - JsonSchemaFactory factory = JsonSchemaFactory.getInstance(SpecVersion.VersionFlag.V202012); - this.gatewaySchema = loadSchema(factory, "/schema/gateway.schema.json"); - this.endpointSchema = loadSchema(factory, "/schema/endpoint.schema.json"); + SchemaRegistry registry = SchemaRegistry.withDefaultDialect(SpecificationVersion.DRAFT_2020_12); + this.gatewaySchema = loadSchema(registry, "/schema/gateway.schema.json"); + this.endpointSchema = loadSchema(registry, "/schema/endpoint.schema.json"); } /** @@ -316,9 +319,18 @@ private static boolean withinExpansionLimits(Path path, String file, List errors) { - Set messages = schema.validate(node); - for (ValidationMessage message : messages) { + private static void validate(Schema schema, JsonNode node, String file, List errors) { + // json-schema-validator 3.x exposes its node API on Jackson 3 (tools.jackson); this loader is + // built on Jackson 2 (com.fasterxml.jackson). Bridge the already-parsed Jackson 2 tree through a + // JSON string so the validator re-parses it with its own mapper — Jackson 3 never enters this code. + String json; + try { + json = JSON_WRITER.writeValueAsString(node); + } catch (JsonProcessingException e) { + errors.add(new ConfigError(file, "", "cannot serialise configuration for schema validation: " + e.getMessage())); + return; + } + for (Error message : schema.validate(json, InputFormat.JSON)) { errors.add(new ConfigError(file, message.getInstanceLocation().toString(), message.getMessage())); } } @@ -464,12 +476,12 @@ private static YAMLFactory hardenedYamlFactory() { .build(); } - private static JsonSchema loadSchema(JsonSchemaFactory factory, String resource) { + private static Schema loadSchema(SchemaRegistry registry, String resource) { try (InputStream stream = ConfigLoader.class.getResourceAsStream(resource)) { if (stream == null) { throw new IllegalStateException("Missing bundled schema resource: " + resource); } - return factory.getSchema(stream); + return registry.getSchema(stream); } catch (IOException e) { throw new IllegalStateException("Cannot read bundled schema resource: " + resource, e); } From 4c6c01ed7b668110712976f0c71263c136801591 Mon Sep 17 00:00:00 2001 From: cuioss oliver <23139298+cuioss@users.noreply.github.com> Date: Thu, 23 Jul 2026 08:22:20 +0200 Subject: [PATCH 3/3] test(config): drop the unreachable serialisation catch to close the coverage gap MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Jackson 2 -> validator bridge used ObjectMapper.writeValueAsString, whose checked JsonProcessingException produced a defensive catch that no real parsed node can reach — 3 uncovered new lines that dropped PR new_coverage to 76.9%. Use JsonNode.toString() instead: it renders the same JSON, is total (no checked exception), and needs no try/catch. The validate path is now fully exercised by the existing config tests. Also drops the now-unused JSON_WRITER field and the JsonProcessingException import. Co-Authored-By: Claude Opus 4.8 (1M context) Claude-Session: https://claude.ai/code/session_01PpXbDJSEs9wAns2MftaBm7 --- .../gateway/config/load/ConfigLoader.java | 17 ++++------------- 1 file changed, 4 insertions(+), 13 deletions(-) diff --git a/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java b/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java index 668bd60..496ec5d 100644 --- a/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java +++ b/api-sheriff/src/main/java/de/cuioss/sheriff/gateway/config/load/ConfigLoader.java @@ -36,7 +36,6 @@ import de.cuioss.sheriff.gateway.config.model.UpstreamDefaultsConfig; import com.fasterxml.jackson.core.JsonParser; -import com.fasterxml.jackson.core.JsonProcessingException; import com.fasterxml.jackson.core.StreamReadConstraints; import com.fasterxml.jackson.databind.DeserializationContext; import com.fasterxml.jackson.databind.JsonDeserializer; @@ -107,8 +106,6 @@ public final class ConfigLoader { private static final Pattern INTEGER = Pattern.compile("-?\\d+"); private static final List SECRET_POINTERS = List.of( "/oidc/client_secret", "/oidc/session/encryption_key", "/oidc/session/previous_key"); - /** Plain JSON writer used only to bridge a parsed Jackson 2 tree to the schema validator's string API. */ - private static final ObjectMapper JSON_WRITER = new ObjectMapper(); private final Path configDir; private final EnvSecretResolver secretResolver; @@ -321,16 +318,10 @@ private static boolean withinExpansionLimits(Path path, String file, List errors) { // json-schema-validator 3.x exposes its node API on Jackson 3 (tools.jackson); this loader is - // built on Jackson 2 (com.fasterxml.jackson). Bridge the already-parsed Jackson 2 tree through a - // JSON string so the validator re-parses it with its own mapper — Jackson 3 never enters this code. - String json; - try { - json = JSON_WRITER.writeValueAsString(node); - } catch (JsonProcessingException e) { - errors.add(new ConfigError(file, "", "cannot serialise configuration for schema validation: " + e.getMessage())); - return; - } - for (Error message : schema.validate(json, InputFormat.JSON)) { + // built on Jackson 2 (com.fasterxml.jackson). Bridge the already-parsed Jackson 2 tree through its + // own JSON rendering (JsonNode.toString() is total — no checked exception) so the validator + // re-parses it with its own mapper; Jackson 3 never enters this code. + for (Error message : schema.validate(node.toString(), InputFormat.JSON)) { errors.add(new ConfigError(file, message.getInstanceLocation().toString(), message.getMessage())); } }