fix(multi-parser)!: drop unmaintained Parser API v1/v2 to fix jsonpath-plus vulnerability - #1242
Open
taylormckayagility wants to merge 1 commit into
Conversation
…h-plus vuln @asyncapi/multi-parser aliased its parserapiv1 and parserapiv2 dependencies to @asyncapi/parser@2.1.0 and @asyncapi/parser@3.0.0-next-major-spec.8, both of which pin jsonpath-plus@^7.2.0 and are unmaintained releases that will never get a security patch (fixes asyncapi#1065). PR asyncapi#1086 tried to work around this by forcing jsonpath-plus to ^10.0.7 via npm overrides inside those old dependency trees, but they were never tested against jsonpath-plus 10.x's changed query behavior and CI hung as a result. Instead, drop Parser API v1/v2 support entirely: NewParser() and ConvertDocumentParserAPIVersion() now throw a clear error directing callers to Parser API v3, which already depends on the patched jsonpath-plus. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0126g1scxgfBLx1rJTLXqeUR
taylormckayagility
requested review from
AayushSaini101,
asyncapi-bot-eve,
magicmatatjahu and
princerajpoot20
as code owners
September 2, 2026 19:21
🦋 Changeset detectedLatest commit: b483c44 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Welcome to AsyncAPI. Thanks a lot for creating your first pull request. Please check out our contributors guide useful for opening a pull request.
Keep in mind there are also other channels you can use to interact with AsyncAPI community. For more details check out this issue.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
@asyncapi/multi-parseraliases two legacy dependencies:parserapiv1→@asyncapi/parser@2.1.0parserapiv2→@asyncapi/parser@3.0.0-next-major-spec.8Both are frozen, unmaintained releases (no
2.1.xpatch has ever shipped past2.1.2, and the3.0.0-next-major-spec.*prerelease line was superseded long ago by the stable3.xrelease) and both pin the vulnerablejsonpath-plus@^7.2.0. Since they're unmaintained, they can never receive a security patch through a normal release — the vulnerability is structurally permanent as long as multi-parser depends on them.This PR removes the
parserapiv1/parserapiv2aliases entirely.NewParser()andConvertDocumentParserAPIVersion()now throw a clear, actionable error when Parser API v1 or v2 is requested, pointing callers to Parser API v3 — which already depends on the patchedjsonpath-plus@^10.0.7(via #1058 and #1062).Why this approach, and not #1086
Fixes #1065.
Supersedes #1086, which is still open and unresolved. That PR forced
jsonpath-plusto^10.0.7via npmoverridesinjected into the oldparserapiv1/parserapiv2dependency trees, without changing which parser version backs v1/v2. The problem: those old parser codebases (2.1.0and3.0.0-next-major-spec.8) were only ever tested against jsonpath-plus 7.x's query behavior, and jsonpath-plus 10.x changed that behavior — CI hung indefinitely as a result (comment).@shivansh-sourceflagged this as a workaround rather than a root-cause fix, and@kraenhansenasked for a better alternative approach.This PR is that alternative: rather than forcing an untested dependency version into dead code, it retires the dead code path. Parser API v1 and v2 consumers get a clear migration error instead of a silently-still-vulnerable dependency.
Breaking change
This is a major release for
@asyncapi/multi-parser(changeset included).NewParser(1),NewParser(2), andConvertDocumentParserAPIVersion(doc, 1)/(doc, 2)now throw instead of returning a v1/v2 parser or document. Callers must migrate to Parser API v3.Verification
npx turbo run build --filter=@asyncapi/multi-parser...— builds clean, no leftover references toparserapiv1/parserapiv2.npm run test:unitinpackages/multi-parser— full suite passes (10/10), and does not hang, unlike feat(multi-parser)!: force json-path-plus to be ^10.0.7 due to security fixed bug #1086.npm ls jsonpath-plusat the repo root shows onlyjsonpath-plus@10.4.0in the tree — the vulnerable7.2.0line is fully gone.Related
@asyncapi/multi-parserstill depending on vulnerable version ofjsonpath-plus#1065🤖 Generated with Claude Code
https://claude.ai/code/session_0126g1scxgfBLx1rJTLXqeUR