[dependabot]

Bumps com.networknt:json-schema-validator from 3.0.8 to 3.0.9.

Release notes

Sourced from com.networknt:json-schema-validator's releases.

3.0.9- 2026-11-03

Breaking changes

• With Ethlo present, date-time now rejects space-separated values such as 2020-01-01 12:00:00Z and leap-second strings without an offset such as 2016-12-31T23:59:60. Ethlo previously accepted these forms. RFC 3339 requires T/t and an explicit Z/z or signed HH:MM offset; callers relying on those spellings must supply the required separator/offset. The fallback already rejected both forms. (#1316)

Added

• Pin public JSON/YAML mapper tree-deserializer delegation with regression tests and document the required checks for Jackson upgrades. #1363
• Opt-in ExecutionConfig.maxEvaluationSteps and maxEvaluationDepth limits for validation and schema walking, including walking without assertions. Exhaustion throws ValidationLimitExceededException instead of returning a partial validity result. Both limits default to unlimited; they bound admitted evaluation steps and schema frames, not work inside a keyword. (#1276, #1289)

Changed

• Decode recognized YAML nonfinite float tokens with Jackson 3.1.8 during tree reads, including explicitly tagged case/sign variants and decimal-mode readers. Preserve the configured nonfinite-to-BigDecimal coercion policy. #1228
• Render null enum members as null in validation errors and avoid listing null twice for nullable schemas. #1373
• Avoid duplicate numeric text-buffer reads when classifying JSON/YAML decimals; pin fast-path boundaries, randomized classification, and Jackson 3 name-matcher cache invalidation with regression tests. #1368
• Reduce decimal-preserving tree parser overhead by caching per token and avoiding text and decimal allocations for lossless floats. #1362
• JsonMapperFactory.getInstance() and YamlMapperFactory.getInstance() now return DecimalNode values for lossy finite floating-point spellings when reading trees, subject to explicit mapper settings and custom node factories. (#1357)
• Preserve lossy finite decimal literals uniformly in built-in JSON/YAML schema and instance readers and public mapper-factory tree reads. Bounds and multipleOf now validate decimal spellings such as 9007199254740993.0 exactly. Decimal nodes can surface in literals, defaults, examples, annotations and JSON output; finite numeric equality no longer depends on the field name. Lossless doubles and signed zero retain type/sign/serialization. Existing overflow/nonfinite behavior, count-specific precision, explicit mapper settings, custom node factories and scalar/POJO binding policies are retained. This intentionally changes validation where values previously rounded to the same double. (#1357)
• Reject space separators in the date-time format when format assertions are enabled, while retaining uppercase T and lowercase t separators. (#1316, #1331) Thanks @​curforever
• Accept RFC 3339 date-time spellings with -00:00, offsets through ±23:59 and fractions longer than nine digits when Ethlo is present. Share grammar/range checks while preserving Ethlo's historical leap-second table and the fallback's possible-leap-second policy; inherited historical-table differences remain. (#1316)
• With typeLoose enabled, numeric enum members now match strings by exact decimal value on both master and 2.x: enum: [100] accepts "100", "100.0" and "1E+2". Previously master required normalized exponent text while 2.x used plain decimal text. This intentionally broadens accepted numeric spellings. Inputs must follow JSON number syntax; whitespace, leading +, leading integer zeros and numeric separators are rejected. Signed zero and equivalent trailing-zero/exponent forms compare equally. Exponents are scanned with bounded arithmetic without expanding zeros or constructing a large exponent integer. Strict mode, literal string members, container handling, non-finite member text and protected enum conversion hooks retain their existing behavior. The comparison uses the enum node's existing decimal value; precision already lost by schema parsing is not recovered. (#1349)
• Share numeric value equality across const, enum and uniqueItems, including numbers nested in arrays and objects. Numeric hashing handles extreme decimal scales without overflowing during trailing-zero normalization; non-finite float and double nodes compare consistently. Preserve enum conversion hooks; skip container members during loose string matching and prepare scalar matching values once. (#1307)
• Preserve count and length limits beyond the int range for minItems, maxItems, minProperties, maxProperties, minLength, maxLength, minContains, and maxContains. Count-limit error arguments are ungrouped Strings; plain integer limits keep their full decimal spelling, while exponent-form decimals remain bounded in size. Contains annotations use the parsed node's own numeric value and type without int-range coercion. Accepted YAML numeric separators retain their meaning. (#1334, #1346)
• Store lossy count values in ordinary DecimalNodes so copies and moved/rebuilt schema trees retain precision without a global side table. Contains annotations expose the node's Number value/type. Integral floating/decimal count messages use plain digits through 100 integer digits and bounded scientific form beyond that; integer nodes keep full spelling. Count tokens outside BigDecimal's parsing range retain ordinary Infinity/underflow behavior. The original count-name-only finite precision policy is generalized in #1357. (#1350)
• Without Ethlo on the classpath, the date-time format now checks the date with the rules of the date format and the time with the rules of the time format instead of OffsetDateTime.parse(..). It rejects a time without seconds (2020-01-01T12:00Z), an offset without minutes (+01) and an empty fraction (12:00:00.Z), which Ethlo already rejected, as well as an offset with seconds (+01:00:00). It accepts an offset up to 23:59 and a fraction longer than nine digits, which RFC 3339 allows, and a leap second at the end of a June 30 or a December 31 in UTC, which it used to reject. Compared with Ethlo, the fallback provides less accurate leap-second validation because it does not check that a leap second was actually inserted on that date. The subsequent shared grammar changes in #1355 also enable these offset/fraction forms with Ethlo and reject space separators on both paths. (#1316, #1337, #1335, #1338) Thanks @​Obrams
• The time format now rejects a leap second with an hour or minute out of range (24:59:60+01:00, 23:89:60+00:30, 45:59:60+22:00), which it used to accept. A time without seconds (12:00Z) was already rejected. (#1316, #1337)
• Ignore zero multipleOf divisors returned by custom validators, regardless of scale, matching the default conversion. (#1328, #1329) Thanks @​PHJ2000
• Display multipleOf divisors in error messages using plain notation when it fits within 32 characters or is no longer than BigDecimal.toString(), including values returned by custom validators. Check the length before expanding to plain notation to avoid excessive padding for extreme scales. (#1328, #1329) Thanks @​PHJ2000
• MultipleOfValidator.getDivisor and getDividend now preserve exact integral and BigDecimal values. Custom validators, including overrides calling super, receive these exact values; validation uses hook results without further rounding. Integral dividend scales can change (for example, 2.0 becomes 2), which affects scale-sensitive comparisons in overrides. Mixed integral/Double or Float inputs above 2^53 can produce different results. Precision already lost when parsing floating-point values is tracked separately in #1293. (#1286, #1290) Thanks @​PHJ2000
• Extend document-root unknown-keyword suppression to external $ref JSON Pointer targets. Keep container and direct-schema caches separate so direct registry loads retain normal diagnostics regardless of registry load order, including rejection by DisallowUnknownKeywordFactory. Within one schema, a whole-document reference following a JSON Pointer reference can still reuse the container and suppress root diagnostics, including strict-factory rejection. Apply the container annotation fallback after nullable/discriminator special handling and make the container marker volatile. (#1325, #1326)
• Treat unknown document-root fields as annotations when loading a schema by JSON Pointer fragment, while preserving known keyword processing and diagnostics in subschemas. With DisallowUnknownKeywordFactory, such fragment loads now succeed instead of throwing on unknown root fields; direct document loads still throw. If the selected schema references the root with $ref: "#", unknown root fields also remain annotations and do not reach the unknown-keyword factory. (#1205, #1323)
• Unlimited validation/walking bypasses execution counters and keeps the original recursion frame structure. During an active limited execution, reentrant convenience calls share the budget and the caller's evaluation path; unlimited calls retain their legacy root-path initialization.
• Exhausted contexts reject public errors/annotation access. Walk listeners can inspect ExecutionContext.isEvaluationAborted() and getEvaluationAbort() during cleanup; an empty error slice after abort is not a validity verdict. Subclass builders supporting limits must use the protected builder constructor or forward both limits explicitly, since the legacy seven-argument constructor remains unlimited.
• Error.getMessageKey() now returns the message key when the schema supplies a custom message, such as type or required, instead of the custom message text. Unresolved $ref, $dynamicRef and $recursiveRef errors return internal.unresolvedRef instead of Reference {0} cannot be resolved. Use getMessage() for the text and isCustomMessage() to detect custom messages. Errors created without a key still use their message pattern as the key. (#1319, #1320)
• Validate fractional seconds and reject trailing text in the time format. (#1308, #1314) Thanks @​MoChiUaena
• Ignore minContains and maxContains before Draft 2019-09, and treat maxContains < minContains as a validation failure rather than a schema error. (#1303, #1295) Thanks @​ItsDeadlyProgrammer
• Correct uniqueItems validation for non-array inputs and compare items without copying them. (#1297, #1305) Thanks @​PHJ2000 and @​ItsDeadlyProgrammer
• Add an error reference document and document recursive applicator costs and invalid multipleOf divisors and bounds. (#1317, #1287, #1332, #1358)
• Ensure the Issue792 and space-separator regression tests run. (#1371) Thanks @​sharanggupta
• Update Ethlo from 1.14.0 to 1.17.0 for date-time offset validation. (#1313) Thanks @​MoChiUaena
• Change Jackson from 3.2.1 to 3.1.8, following intermediate upgrades to 3.2.3 and 3.2.4. (231c34b, 377877b, 558cc18)
• Upgrade SLF4J from 2.0.19 to 2.0.20, test dependencies Logback from 1.6.3 to 1.6.6 and JUnit from 6.0.1 to 6.1.3, Maven GPG from 3.2.7 to 3.2.8, and Central Publishing from 0.11.0 to 0.12.0. (95825f3, 83905ab, 16f3495, f2d22d1, 5515315, 276fd58)

Changelog

Sourced from com.networknt:json-schema-validator's changelog.

Change Log

All notable changes to this project will be documented in this file.

This format is based on Keep a Changelog.

This project does not adhere to Semantic Versioning and minor version changes can have incompatible API changes. These incompatible API changes will largely affect those who have custom validator or walker implementations. Those who just use the library to validate using the standard JSON Schema Draft specifications may not need changes.

[Unreleased]

Changed

• hostname rejects names longer than 253 characters.
• hostname checks a label that starts with xn--, in any case, as an A-label. It must be at most 63 characters of Punycode that encodes back to itself, and its U-label must pass the IDNA2008 rules listed below. xn--X, xn--hello-txk and xn--1-0hc (U-label 1א, which breaks the RFC 5893 Bidi Rule) are now rejected; before, any LDH label passed. The Bidi Rule applies within each A-label only: the other labels stay RFC 1123 LDH labels, so 3com.xn--mgbaam7a8h remains valid.
• idn-hostname decodes A-labels with an RFC 3492 Punycode decoder instead of java.net.IDN (IDNA2003). A-labels with characters IDNA2008 allows in context, such as U+00DF, U+03C2, U+200C and U+200D, are accepted when the RFC 5892 rules allow them. A-labels are case-insensitive.
• idn-hostname measures the 63-character label limit in A-label form for U-labels too, and limits names to 253 characters in A-label form.
• idn-hostname rejects more than one trailing label separator, such as a.. and xn--4dbc..; before, any number was accepted. A single trailing separator is still accepted and does not count toward the 253 characters.
• IDNA2008 rules, for both formats:
  • Hyphen positions are counted in code points, and each supplementary code point is tested once rather than as two surrogates.
  • ZWJ and ZWNJ are accepted after any virama (Canonical_Combining_Class 9, as of Unicode 16.0), not only U+094D. The ZWNJ joining-type check steps over supplementary transparent marks.
  • The KATAKANA MIDDLE DOT, GREEK LOWER NUMERAL SIGN and Hebrew GERESH/GERSHAYIM rules use the Unicode script rather than code blocks. KATAKANA MIDDLE DOT accepts a Hiragana, Katakana or Han character anywhere in the label (RFC 5892 A.7).
  • RFC 5893 Bidi Rule: a label with an R, AL or AN character must satisfy the rule, so 0ا is an invalid idn-hostname and xn--1-0hc (1א) an invalid hostname label. In idn-hostname, every other label of such a name must satisfy it too, so 1a.אב and 1a.xn--4dbc are invalid there.
  • Following RFC 6452, U+0CF1 and U+0CF2 are valid and U+19DA is not, overriding the bundled table.
  • The Unicode tables load safely across threads.
• Code points added after Unicode 5.2: the bundled RFC 5892 Appendix B table predates them, so they are classified with the running JDK's Unicode data, approximating the RFC 5892 derivation. Letters, marks and digits that are stable under NFKC and case folding are accepted, such as Adlam small letters and new Cherokee capitals. Emoji, symbols, upper case, format controls, letters that fold to another letter (U+1C80) and the default-ignorable U+180F are rejected, as are Cherokee small letters.
• Known limits:
  • Verdicts for code points newer than the JDK's Unicode version depend on the JDK. For example, a Unicode 14 letter is rejected on Java 17 (Unicode 13) and accepted on Java 21.
  • The virama list stops at Unicode 16.0.
  • idn-hostname does not apply UTS 46 mapping, and still accepts a single trailing label separator (example.).
• Removed the unused UnicodeDatabase.isGreek, isHebrew and isKatakana, which tested code blocks rather than scripts.
• Updated the vendored hostname.json and idn-hostname.json suite files to the current JSON-Schema-Test-Suite, including draft-next. Cases that need UTS 46 mapping or trailing-separator rejection are disabled with a reason.

Fixed

• Prevent descendant discriminator state from leaking between oneOf and anyOf branches in OpenAPI 3.0 and 3.1. #1378

3.0.9- 2026-11-03

Breaking changes

• With Ethlo present, date-time now rejects space-separated values such as 2020-01-01 12:00:00Z and leap-second strings without an offset such as 2016-12-31T23:59:60. Ethlo previously accepted these forms. RFC 3339 requires T/t and an explicit Z/z or signed HH:MM offset; callers relying on those spellings must supply the required separator/offset. The fallback already rejected both forms. (#1316)

Added

• Pin public JSON/YAML mapper tree-deserializer delegation with regression tests and document the required checks for Jackson upgrades. #1363
• Opt-in ExecutionConfig.maxEvaluationSteps and maxEvaluationDepth limits for validation and schema walking, including walking without assertions. Exhaustion throws ValidationLimitExceededException instead of returning a partial validity result. Both limits default to unlimited; they bound admitted evaluation steps and schema frames, not work inside a keyword. (#1276, #1289)

Changed

• Decode recognized YAML nonfinite float tokens with Jackson 3.1.8 during tree reads, including explicitly tagged case/sign variants and decimal-mode readers. Preserve the configured nonfinite-to-BigDecimal coercion policy. #1228
• Render null enum members as null in validation errors and avoid listing null twice for nullable schemas. #1373
• Avoid duplicate numeric text-buffer reads when classifying JSON/YAML decimals; pin fast-path boundaries, randomized classification, and Jackson 3 name-matcher cache invalidation with regression tests. #1368
• Reduce decimal-preserving tree parser overhead by caching per token and avoiding text and decimal allocations for lossless floats. #1362
• JsonMapperFactory.getInstance() and YamlMapperFactory.getInstance() now return DecimalNode values for lossy finite floating-point spellings when reading trees, subject to explicit mapper settings and custom node factories. (#1357)

... (truncated)

Commits

• 75c95ec Fix YAML nonfinite tree reads with Jackson 3.1.8 (#1375)
• 1f3f96c upgrade to 3.0.9 and update changelog
• 558cc18 downgrade jackson to 3.1.8 from 3.2.4
• 276fd58 upgrade central-publishing-maven to 0.12.0 from 0.11.0
• 16f3495 upgrade logback to 1.6.6 from 1.6.5
• 377877b upgrade jackson to 3.2.4 from 3.2.3
• 498143f Fix null enum members in validation error messages (#1374)
• 53a6c00 Run Issue792 and DateTimeFormatTest.bothPathsRejectSpaceSeparator tests (#1371)
• b2ca3ea Pin decimal fast-path boundaries and reuse token characters (#1369)
• 878a27f Pin Jackson tree-deserializer delegation behavior (#1366)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: e3cfdaa5-1063-4d00-aea5-dcdeddccb25a

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.84%. Comparing base (479fd2d) to head (48844ff).

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #7055   +/-   ##
=========================================
  Coverage     97.84%   97.84%           
  Complexity     7439     7439           
=========================================
  Files          1028     1028           
  Lines         21924    21924           
  Branches       1451     1451           
=========================================
  Hits          21451    21451           
  Misses          357      357           
  Partials        116      116           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.