fix(multi-parser)!: drop unmaintained Parser API v1/v2 to fix jsonpath-plus vulnerability

.changeset/drop-vulnerable-legacy-parsers.md

@@ -0,0 +1,9 @@
+---
+"@asyncapi/multi-parser": major
+---
+
+Drop support for Parser API v1 and v2.
+
+Both were implemented via aliased dependencies on unmaintained, frozen releases (`@asyncapi/parser@2.1.0` for v1, `@asyncapi/parser@3.0.0-next-major-spec.8` for v2), both of which depend on the vulnerable `jsonpath-plus@^7.2.0` and will never receive a security patch (see #1065). `NewParser()` and `ConvertDocumentParserAPIVersion()` now throw a clear error when v1 or v2 is requested, directing callers to migrate to Parser API v3, which already depends on the patched `jsonpath-plus@^10.0.7`.
+
+This supersedes #1086, which attempted to fix the same vulnerability by forcing `jsonpath-plus` to a newer version inside the old v1/v2 dependency trees via npm `overrides`. That approach left those unmaintained codebases running against a jsonpath-plus major version they were never tested against, which caused CI to hang.

packages/multi-parser/package.json

@@ -42,9 +42,7 @@
     "@asyncapi/avro-schema-parser": "^3.0.3",
     "@asyncapi/openapi-schema-parser": "*",
     "@asyncapi/parser": "*",
-    "@asyncapi/protobuf-schema-parser": "^3.8.3",
-    "parserapiv1": "npm:@asyncapi/parser@^2.1.0",
-    "parserapiv2": "npm:@asyncapi/parser@3.0.0-next-major-spec.8"
+    "@asyncapi/protobuf-schema-parser": "^3.8.3"
   },
   "peerDependencies": {
     "@asyncapi/raml-dt-schema-parser": "^4.0.4"

packages/multi-parser/src/convert.ts

@@ -1,16 +1,10 @@
-import { createAsyncAPIDocument as createAsyncAPIDocumentParserV1 } from 'parserapiv1';
-import { createAsyncAPIDocument as createAsyncAPIDocumentParserV2 } from 'parserapiv2';
 import { createAsyncAPIDocument as createAsyncAPIDocumentParserV3 } from '@asyncapi/parser';
 
-import type { AsyncAPIDocumentInterface as AsyncAPIDocumentInterfaceParserV1 } from 'parserapiv1';
-import type { AsyncAPIDocumentInterface as AsyncAPIDocumentInterfaceParserV2 } from 'parserapiv2';
 import type { AsyncAPIDocumentInterface as AsyncAPIDocumentInterfaceParserV3 } from '@asyncapi/parser';
 
-import type { DetailedAsyncAPI as DetailedAsyncAPIParserV1 } from 'parserapiv1/esm/types';
-import type { DetailedAsyncAPI as DetailedAsyncAPIParserV2 } from 'parserapiv2/esm/types';
 import type { DetailedAsyncAPI as DetailedAsyncAPIParserV3 } from '@asyncapi/parser/esm/types';
 
-export type AsyncAPIDocument = AsyncAPIDocumentInterfaceParserV1 | AsyncAPIDocumentInterfaceParserV2 | AsyncAPIDocumentInterfaceParserV3;
+export type AsyncAPIDocument = AsyncAPIDocumentInterfaceParserV3;
 
 export function ConvertDocumentParserAPIVersion(doc: AsyncAPIDocument, toParserAPIMajorVersion: number): AsyncAPIDocument {
   if (!doc || !doc.json) return doc;
@@ -25,12 +19,11 @@ export function ConvertDocumentParserAPIVersion(doc: AsyncAPIDocument, toParserA
   const detailedAsyncAPI = doc.meta().asyncapi;
   switch (toParserAPIMajorVersion) {
   case 1:
-    return createAsyncAPIDocumentParserV1(detailedAsyncAPI as DetailedAsyncAPIParserV1);
   case 2:
-    return createAsyncAPIDocumentParserV2(detailedAsyncAPI as DetailedAsyncAPIParserV2);
+    throw new Error(`Parser API v${toParserAPIMajorVersion} is no longer supported because its pinned dependency carries an unpatchable jsonpath-plus vulnerability (see https://github.com/asyncapi/parser-js/issues/1065). Use Parser API v3 instead.`);
   case 3:
     return createAsyncAPIDocumentParserV3(detailedAsyncAPI as DetailedAsyncAPIParserV3);
-  default: 
+  default:
     return doc;
   }
 }

packages/multi-parser/src/parse.ts

@@ -1,5 +1,3 @@
-import { Parser as ParserV1 } from 'parserapiv1';
-import { Parser as ParserV2 } from 'parserapiv2';
 import { Parser as ParserV3 } from '@asyncapi/parser';
 
 import { AvroSchemaParser } from '@asyncapi/avro-schema-parser';
@@ -8,17 +6,15 @@ import { ProtoBuffSchemaParser } from '@asyncapi/protobuf-schema-parser';
 
 import { loadRamlDTSchemaParser } from './raml-dt-schema-parser-loader';
 
-import type { ParserOptions as ParserOptionsParserV1 } from 'parserapiv1/esm/parser';
-import type { ParserOptions as ParserOptionsParserV2 } from 'parserapiv2/esm/parser';
 import type { ParserOptions as ParserOptionsParserV3 } from '@asyncapi/parser/esm/parser';
 
-export type ParserOptions = ParserOptionsParserV1 | ParserOptionsParserV2 | ParserOptionsParserV3;
+export type ParserOptions = ParserOptionsParserV3;
 export type Options = {
   includeSchemaParsers?: boolean;
   parserOptions?: ParserOptions;
 }
 
-type Parser = ParserV1 | ParserV2 | ParserV3;
+type Parser = ParserV3;
 
 export function NewParser(parserAPIMajorVersion?: number, options?: Options): Parser {
   const parserOptions: ParserOptions = options?.parserOptions || {};
@@ -46,11 +42,10 @@ export function NewParser(parserAPIMajorVersion?: number, options?: Options): Pa
 
   switch (parserAPIMajorVersion) {
   case 1:
-    return new ParserV1(parserOptions as ParserOptionsParserV1);
   case 2:
-    return new ParserV2(parserOptions as ParserOptionsParserV2);
+    throw new Error(`Parser API v${parserAPIMajorVersion} is no longer supported because its pinned dependency carries an unpatchable jsonpath-plus vulnerability (see https://github.com/asyncapi/parser-js/issues/1065). Use Parser API v3 instead.`);
   default: // default to latest version
   case 3:
     return new ParserV3(parserOptions as ParserOptionsParserV3);
-  }   
+  }
 }