Moderate vulnerabilities in transitive dependencies (validator → z-schema → swagger-parser → swagger-jsdoc

[soukainakhalkhouli]

Package: swagger-jsdoc@6.2.8
Environment:

• Node.js version: v22.19.0
• npm version: 10.9.3
• OS: macOS Sequoia 15.0.1

Description:
When running npm audit in a Docker build step (STEP 11/15), the following occurs:

STEP 11/15: RUN if [ "$RUN_AUDIT" = "true" ]; then npm audit --omit=dev; else echo "Skipping audit"; fi

The audit reports 5 moderate severity vulnerabilities in the transitive dependency chain:

validator → z-schema → @apidevtools/swagger-parser → swagger-jsdoc

Steps to Reproduce:

1. Include swagger-jsdoc@6.2.8 in a project.
2. Run npm audit (or build a Docker image with $RUN_AUDIT=true).
3. Observe the reported vulnerabilities.

Expected Behavior:
No vulnerabilities in the dependency chain or guidance on mitigation.

Additional Context:

• This seems to be caused by deep transitive dependencies (validator, z-schema, swagger-parser).
• Advisory reference: GHSA-9965-vmph-33xx

[soukainakhalkhouli]

Team I want to flag a moderate-risk issue with swagger-jsdoc that could impact our production release.
The vulnerabilities are in the transitive dependencies (validator → z-schema → swagger-parser → swagger-jsdoc) Could you please check it and let us know

[soukainakhalkhouli]

@daniloab Any help on this please

[sfgoncalvesm]

Unfortunately I am facing the same problem

[soukainakhalkhouli]

Is it gonna solve soon?

[sfgoncalvesm]

I don't know, from what I saw, a PR was merged with the fix.
It's waiting for a project maintainer to approve it.

#425

[McFizh]

This project doesn't seem to be active anymore, so I've created a fork that fixes security issues 426 and 277:

https://www.npmjs.com/package/@deadendjs/swagger-jsdoc

I've also done modernization on the codebase, so there are some small(ish) breaking changes.

[mkonikov]

Shame that this useful package is kinda dead.