[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
com.networknt:json-schema-validator	1.5.9 → 3.0.9

---

Release Notes

networknt/json-schema-validator (com.networknt:json-schema-validator)

v3.0.9

Compare Source

Breaking changes

• With Ethlo present, date-time now rejects space-separated values such as 2020-01-01 12:00:00Z and leap-second strings without an offset such as 2016-12-31T23:59:60. Ethlo previously accepted these forms. RFC 3339 requires T/t and an explicit Z/z or signed HH:MM offset; callers relying on those spellings must supply the required separator/offset. The fallback already rejected both forms. (#​1316)

Added

• Pin public JSON/YAML mapper tree-deserializer delegation with regression tests and document the required checks for Jackson upgrades. #​1363
• Opt-in ExecutionConfig.maxEvaluationSteps and maxEvaluationDepth limits for validation and schema walking, including walking without assertions. Exhaustion throws ValidationLimitExceededException instead of returning a partial validity result. Both limits default to unlimited; they bound admitted evaluation steps and schema frames, not work inside a keyword. (#​1276, #​1289)

Changed

• Decode recognized YAML nonfinite float tokens with Jackson 3.1.8 during tree reads, including explicitly tagged case/sign variants and decimal-mode readers. Preserve the configured nonfinite-to-BigDecimal coercion policy. #​1228
• Render null enum members as null in validation errors and avoid listing null twice for nullable schemas. #​1373
• Avoid duplicate numeric text-buffer reads when classifying JSON/YAML decimals; pin fast-path boundaries, randomized classification, and Jackson 3 name-matcher cache invalidation with regression tests. #​1368
• Reduce decimal-preserving tree parser overhead by caching per token and avoiding text and decimal allocations for lossless floats. #​1362
• JsonMapperFactory.getInstance() and YamlMapperFactory.getInstance() now return DecimalNode values for lossy finite floating-point spellings when reading trees, subject to explicit mapper settings and custom node factories. (#​1357)
• Preserve lossy finite decimal literals uniformly in built-in JSON/YAML schema and instance readers and public mapper-factory tree reads. Bounds and multipleOf now validate decimal spellings such as 9007199254740993.0 exactly. Decimal nodes can surface in literals, defaults, examples, annotations and JSON output; finite numeric equality no longer depends on the field name. Lossless doubles and signed zero retain type/sign/serialization. Existing overflow/nonfinite behavior, count-specific precision, explicit mapper settings, custom node factories and scalar/POJO binding policies are retained. This intentionally changes validation where values previously rounded to the same double. (#​1357)
• Reject space separators in the date-time format when format assertions are enabled, while retaining uppercase T and lowercase t separators. (#​1316, #​1331) Thanks @​curforever
• Accept RFC 3339 date-time spellings with -00:00, offsets through ±23:59 and fractions longer than nine digits when Ethlo is present. Share grammar/range checks while preserving Ethlo's historical leap-second table and the fallback's possible-leap-second policy; inherited historical-table differences remain. (#​1316)
• With typeLoose enabled, numeric enum members now match strings by exact decimal value on both master and 2.x: enum: [100] accepts "100", "100.0" and "1E+2". Previously master required normalized exponent text while 2.x used plain decimal text. This intentionally broadens accepted numeric spellings. Inputs must follow JSON number syntax; whitespace, leading +, leading integer zeros and numeric separators are rejected. Signed zero and equivalent trailing-zero/exponent forms compare equally. Exponents are scanned with bounded arithmetic without expanding zeros or constructing a large exponent integer. Strict mode, literal string members, container handling, non-finite member text and protected enum conversion hooks retain their existing behavior. The comparison uses the enum node's existing decimal value; precision already lost by schema parsing is not recovered. (#​1349)
• Share numeric value equality across const, enum and uniqueItems, including numbers nested in arrays and objects. Numeric hashing handles extreme decimal scales without overflowing during trailing-zero normalization; non-finite float and double nodes compare consistently. Preserve enum conversion hooks; skip container members during loose string matching and prepare scalar matching values once. (#​1307)
• Preserve count and length limits beyond the int range for minItems, maxItems, minProperties, maxProperties, minLength, maxLength, minContains, and maxContains. Count-limit error arguments are ungrouped Strings; plain integer limits keep their full decimal spelling, while exponent-form decimals remain bounded in size. Contains annotations use the parsed node's own numeric value and type without int-range coercion. Accepted YAML numeric separators retain their meaning. (#​1334, #​1346)
• Store lossy count values in ordinary DecimalNodes so copies and moved/rebuilt schema trees retain precision without a global side table. Contains annotations expose the node's Number value/type. Integral floating/decimal count messages use plain digits through 100 integer digits and bounded scientific form beyond that; integer nodes keep full spelling. Count tokens outside BigDecimal's parsing range retain ordinary Infinity/underflow behavior. The original count-name-only finite precision policy is generalized in #​1357. (#​1350)
• Without Ethlo on the classpath, the date-time format now checks the date with the rules of the date format and the time with the rules of the time format instead of OffsetDateTime.parse(..). It rejects a time without seconds (2020-01-01T12:00Z), an offset without minutes (+01) and an empty fraction (12:00:00.Z), which Ethlo already rejected, as well as an offset with seconds (+01:00:00). It accepts an offset up to 23:59 and a fraction longer than nine digits, which RFC 3339 allows, and a leap second at the end of a June 30 or a December 31 in UTC, which it used to reject. Compared with Ethlo, the fallback provides less accurate leap-second validation because it does not check that a leap second was actually inserted on that date. The subsequent shared grammar changes in #​1355 also enable these offset/fraction forms with Ethlo and reject space separators on both paths. (#​1316, #​1337, #​1335, #​1338) Thanks @​Obrams
• The time format now rejects a leap second with an hour or minute out of range (24:59:60+01:00, 23:89:60+00:30, 45:59:60+22:00), which it used to accept. A time without seconds (12:00Z) was already rejected. (#​1316, #​1337)
• Ignore zero multipleOf divisors returned by custom validators, regardless of scale, matching the default conversion. (#​1328, #​1329) Thanks @​PHJ2000
• Display multipleOf divisors in error messages using plain notation when it fits within 32 characters or is no longer than BigDecimal.toString(), including values returned by custom validators. Check the length before expanding to plain notation to avoid excessive padding for extreme scales. (#​1328, #​1329) Thanks @​PHJ2000
• MultipleOfValidator.getDivisor and getDividend now preserve exact integral and BigDecimal values. Custom validators, including overrides calling super, receive these exact values; validation uses hook results without further rounding. Integral dividend scales can change (for example, 2.0 becomes 2), which affects scale-sensitive comparisons in overrides. Mixed integral/Double or Float inputs above 2^53 can produce different results. Precision already lost when parsing floating-point values is tracked separately in #​1293. (#​1286, #​1290) Thanks @​PHJ2000
• Extend document-root unknown-keyword suppression to external $ref JSON Pointer targets. Keep container and direct-schema caches separate so direct registry loads retain normal diagnostics regardless of registry load order, including rejection by DisallowUnknownKeywordFactory. Within one schema, a whole-document reference following a JSON Pointer reference can still reuse the container and suppress root diagnostics, including strict-factory rejection. Apply the container annotation fallback after nullable/discriminator special handling and make the container marker volatile. (#​1325, #​1326)
• Treat unknown document-root fields as annotations when loading a schema by JSON Pointer fragment, while preserving known keyword processing and diagnostics in subschemas. With DisallowUnknownKeywordFactory, such fragment loads now succeed instead of throwing on unknown root fields; direct document loads still throw. If the selected schema references the root with $ref: "#", unknown root fields also remain annotations and do not reach the unknown-keyword factory. (#​1205, #​1323)
• Unlimited validation/walking bypasses execution counters and keeps the original recursion frame structure. During an active limited execution, reentrant convenience calls share the budget and the caller's evaluation path; unlimited calls retain their legacy root-path initialization.
• Exhausted contexts reject public errors/annotation access. Walk listeners can inspect ExecutionContext.isEvaluationAborted() and getEvaluationAbort() during cleanup; an empty error slice after abort is not a validity verdict. Subclass builders supporting limits must use the protected builder constructor or forward both limits explicitly, since the legacy seven-argument constructor remains unlimited.
• Error.getMessageKey() now returns the message key when the schema supplies a custom message, such as type or required, instead of the custom message text. Unresolved $ref, $dynamicRef and $recursiveRef errors return internal.unresolvedRef instead of Reference {0} cannot be resolved. Use getMessage() for the text and isCustomMessage() to detect custom messages. Errors created without a key still use their message pattern as the key. (#​1319, #​1320)
• Validate fractional seconds and reject trailing text in the time format. (#​1308, #​1314) Thanks @​MoChiUaena
• Ignore minContains and maxContains before Draft 2019-09, and treat maxContains < minContains as a validation failure rather than a schema error. (#​1303, #​1295) Thanks @​ItsDeadlyProgrammer
• Correct uniqueItems validation for non-array inputs and compare items without copying them. (#​1297, #​1305) Thanks @​PHJ2000 and @​ItsDeadlyProgrammer
• Add an error reference document and document recursive applicator costs and invalid multipleOf divisors and bounds. (#​1317, #​1287, #​1332, #​1358)
• Ensure the Issue792 and space-separator regression tests run. (#​1371) Thanks @​sharanggupta
• Update Ethlo from 1.14.0 to 1.17.0 for date-time offset validation. (#​1313) Thanks @​MoChiUaena
• Change Jackson from 3.2.1 to 3.1.8, following intermediate upgrades to 3.2.3 and 3.2.4. (231c34b, 377877b, 558cc18)
• Upgrade SLF4J from 2.0.19 to 2.0.20, test dependencies Logback from 1.6.3 to 1.6.6 and JUnit from 6.0.1 to 6.1.3, Maven GPG from 3.2.7 to 3.2.8, and Central Publishing from 0.11.0 to 0.12.0. (95825f3, 83905ab, 16f3495, f2d22d1, 5515315, 276fd58)

v3.0.8

Compare Source

Added

Changed

• Expose Error.isCustomMessage() to identify messages supplied by the schema through the configured error message keyword, while preserving the existing Error constructor's binary compatibility and JSON serialization format. (680d7b3, f8c7659)
• Reject leading or interior empty labels and names consisting only of label separators in the idn-hostname format (#​1274) Thanks @​dngr2
• Allow apostrophes in uri-template literals (#​1275) Thanks @​dngr2
• Honor PathType when formatting schema locations in DiscriminatorValidator exceptions (#​1281) Thanks @​youdie006
• Resolve the OpenAPI nullable keyword through allOf/oneOf/anyOf, if/then/else and $ref/$dynamicRef/$recursiveRef ancestors, to any depth and in any order. nullable on a schema composed through these keywords now applies to the value they describe, for both the type and enum keywords (#​1278, #​1279, #​1283) Thanks @​tomakehurst
• nullable on a container no longer applies to the values described by its properties, items and additionalProperties subschemas. Previously a nullable container made its children accept null. Schemas relying on that must declare nullable on the child itself. (#​1283) Thanks @​tomakehurst
• oneOf no longer requires exactly one matching branch when the value is null and a nullable ancestor permits it. Every branch accepts null in that case, so {"nullable": true, "oneOf": [ ... ]} previously reported that more than one branch matched. Branch errors are still reported when no branch matches. (#​1283) Thanks @​tomakehurst
• nullable no longer applies inside a not subschema, so {"nullable": true, "not": {"type": "string"}} now accepts null where it previously reported a not error. (#​1283) Thanks @​tomakehurst
• With typeLoose enabled, the empty string no longer satisfies an enum on a nullable schema. null was previously held in the accepted set and compared as text, where it renders as the empty string, so {"enum": ["a"], "nullable": true} accepted "". Only an actual null is accepted now. (#​1283) Thanks @​tomakehurst
• A nullable declared alongside $ref is now ignored at the root of an OpenAPI 3.0 schema as it already was elsewhere, so {"$ref": "...", "nullable": true} rejects null. Siblings of a Reference Object are ignored in OpenAPI 3.0. (#​1283) Thanks @​tomakehurst
• Add regression coverage for YAML .nan, .inf and -.inf values producing validation type errors instead of parser exceptions with Jackson 3.2.1 (#​1228, #​1282) Thanks @​patpatpat123
• Upgrade SLF4J from 2.0.17 to 2.0.19 and the test dependency Logback from 1.5.22 to 1.6.3. (759445b, 3d9971d, 2575a02)
• Upgrade Maven Surefire and Surefire Report from 3.5.4 to 3.6.0, and the Central Publishing Maven plugin from 0.7.0 to 0.11.0. (f26327c, 4649209)
• Upgrade the benchmark workflow to actions/checkout@v7 and actions/setup-java@v6. (6f5d6c1)

v3.0.7

Compare Source

Added

Changed

• fixes #​1277 upgrade jackson to 3.2.1 to resolve a security vulnerability
• ix: uniqueItems compares numbers by value, not by node type (#​1273) Thanks @​dngr2
• Honor PathType when formatting SchemaException locations (#​1272) Thanks @​kalayciburak
• Reject non-ASCII whitespace in idn-email and format tests (#​1268) Thanks @​el-psy-kongroo-d
• Reject non-ASCII whitespace in email format (#​1267) Thanks @​el-psy-kongroo-d

v3.0.6

Compare Source

Added

Changed

• Fall back to the library class loader for classpath resources (#​1265) Thanks @​joaodinissf
• Add schema tests (#​1260) (#​1261) Thanks @​gjvoosten
• Bump jackson to 3.1.4 to fix CVE-2026-54512 and CVE-2026-54513 (#​1263) Thanks @​olinoskar
• Reduce per-validation allocation in ExecutionContext (#​1259) Thanks @​nishantmehta
• test: re-enable and strengthen recursive $ref SelfRefTest (#​1258) Thanks @​koteshyelamati
• simplify additionalItems validation flow (#​1256) Thanks @​Oz-er

v3.0.5

Compare Source

Added

Changed

• fixes #​1252 problem with additionalProperties schema in jsconfig schema (#​1253)
• fixes #​1174 TextNodes as schema seem to validate any value (#​1250)

v3.0.4

Compare Source

Added

Changed

• fixes #​1248 validating draft4 schemas (#​1249)

v3.0.3

Compare Source

Added

Changed

• fixes #​1246 Coercion bug (#​1247)
• Cleanup of IOException leftovers after update to jackson3 (#​1244) Thanks @​afiluba

v3.0.2

Compare Source

Added

Changed

• Upgrade Jackson from 3.1.0 to 3.1.1 to fix CWE-770 (#​1236) Thanks @​cjun-coveo
• Support handling of non-finite numbers if present (#​1241) Thanks @​justin-tay

v3.0.1

Compare Source

Added

Changed

• Upgrade Jackson from 3.0.3 to 3.1.0 to fix CVE-2026-29062 (#​1236) Thanks @​AhsanSheraz
• Fix minimum maximum validators with type array (#​1227) Thanks @​justin-tay
• Add method to SpecificationVersion to determine from schema node (#​1221) Thanks @​justin-tay
• update contributor list in README.md

v3.0.0

Compare Source

Added

Changed

• Upgrade to Jackson 3 and JDK 17 (#​1219) Thanks @​justin-tay

v2.0.8

Compare Source

2.0.8- 2026-10-01

Added

Changed

• Resolve the OpenAPI nullable keyword through allOf/oneOf/anyOf, if/then/else and $ref/$dynamicRef/$recursiveRef ancestors, to any depth and in any order. nullable on a schema composed through these keywords now applies to the value they describe, for both the type and enum keywords.
• nullable on a container no longer applies to the values described by its properties, items and additionalProperties subschemas. Previously a nullable container made an inline (non-$ref) child accept null. Schemas relying on that must declare nullable on the child itself.
• oneOf no longer requires exactly one matching branch when the value is null and a nullable ancestor permits it. Every branch accepts null in that case, so {"nullable": true, "oneOf": [ ... ]} previously reported that more than one branch matched. Branch errors are still reported when no branch matches.
• nullable no longer applies inside a not subschema, so {"nullable": true, "not": {"type": "string"}} now accepts null where it previously reported a not error.
• With typeLoose enabled, the string "null" no longer satisfies an enum on a nullable schema. {"enum": ["a"], "nullable": true} previously accepted the string "null" as well as an actual null; only an actual null is accepted now.

v2.0.7

Compare Source

2.0.7- 2026-08-20

Added

Changed

• Preserve binary compatibility for the Error constructor after adding custom-message metadata.

GitHub tag correction: this tag previously pointed to a 3.x commit on master. It now points to the verified 2.x release commit ae64ed637f743c4a88b2a391f20b639fe7f7d8e3, whose POM and all 222 published Java source files match Maven Central. The published Maven artifacts were already correct.

v2.0.6

Compare Source

2.0.6- 2026-08-20

Added

• Add Error.isCustomMessage() to identify schema-supplied validation messages.

Changed

Restored missing GitHub tag and release. The release commit was verified against the existing Maven Central POM and all 222 published Java source files.

v2.0.5

Compare Source

2.0.5- 2026-08-20

Added

Changed

• upgrade jackson to 2.22.1 to resolve a security vulnerability

GitHub tag correction: this tag previously pointed to a 3.x commit on master. It now points to the verified 2.x release commit 1fedf7133bb9ba4b41c7e3575abea01a6d5b61d0, whose POM and all 222 published Java source files match Maven Central. The published Maven artifacts were already correct.

v2.0.4

Compare Source

2.0.4- 2026-07-07

Added

Changed

• Fall back to the library class loader for classpath resources (#​1266) Thanks @​joaodinissf

GitHub tag correction: this tag previously pointed to a 3.x commit on master. It now points to the verified 2.x release commit 2ad25293fe9f28a43867b2e57fabb0a01f68317f, whose POM and all 222 published Java source files match Maven Central. The published Maven artifacts were already correct.

v2.0.3

Compare Source

2.0.3- 2026-06-23

Added

Changed

• release with JDK 11
• fixes 2.0.2 published jar is missing module-info.class — JPMS module com.networknt.schema no longer resolves

GitHub tag correction: this tag previously pointed to a 3.x commit on master. It now points to the verified 2.x release commit 8f2afe9090b1745b920fdbebf8f2a4f707eba0a5, whose POM and all 222 published Java source files match Maven Central. The published Maven artifacts were already correct.

v2.0.2

Compare Source

2.0.2- 2026-06-21

Added

Changed

• fixes #​1248 validating draft4 schemas (#​1249)

• fixes #​1248 validating draft4 schemas

• Address regex factory review comments

• Rename regex specification version variable

• fixes #​1174 TextNodes as schema seem to validate any value (#​1250)

• fixes #​1174 TextNodes as schema seem to validate any value

• Address loaded schema validation for issue 1174

• Address schema node validation review comments

• Preserve mapped schema override path

• Validate referenced document fragment schemas

• Remove duplicate schema type validation

• Validate loaded schemas for anchor refs

• fixes #​1252 problem with additionalProperties schema in jsconfig schema (#​1253)

• Add method to SpecificationVersion to determine from schema node (#​1221)

• Manual adjustments for Jackson 2 compatibility and CVE fix

GitHub tag correction: this tag previously pointed to a 3.x commit on master. It now points to the verified 2.x release commit a3e58d9e55754e940277d2a1342bb1d3c2061e69, whose POM and all 222 published Java source files match Maven Central. The published Maven artifacts were already correct.

v2.0.1

Compare Source

Added

Changed

• Skip processing of properties keyword if not an object (#​1217) Thanks @​justin-tay
• Allow for default dialect id not to be specified and throw an exception (#​1212) Thanks @​justin-tay
• Fix multipleOf error message for fractional digits greater than 3 (#​1210) Thanks @​justin-tay

v2.0.0

Compare Source

Added

Changed

• Fix ref with sibling id from 2019-09 (#​1203) Thanks @​justin-tay
• Refactor walk and update docs (#​1202) Thanks @​justin-tay
• Fix matching of $ when there are trailing newlines (#​1201) Thanks @​justin-tay
• Refactor evaluation context out from validator state (#​1199) Thanks @​justin-tay
• Main refactor for 2.x (#​1198) Thanks @​justin-tay
• Refactor set to list in execution context (#​1197) Thanks @​justin-tay
• Refactor and remove validation message handler (#​1196) Thanks @​justin-tay
• Add benchmark for performance regression testing (#​1195) Thanks @​justin-tay

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: bc708fb3-d0e8-4ff2-8e83-7aae1a3a8d4a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[Pfeil]

see #333