Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Drop swagger-ui v2 in favor of v4 #22

Closed

Conversation

RobbeSneyders
Copy link
Member

Fixes #20.

Dropping v2 means we lose support for swagger / openapi versions 1.X.
However, swagger 2.0 was released in 2014 and Swagger 1.X doesn't seem to get a lot of usage anymore.

This is a breaking change, so I would propose to release this with a major version bump.

swagger_ui_3_path = swagger_ui_3_52_0_path
swagger_ui_4_path = swagger_ui_4_4_0_path

# default to swagger 3
swagger_ui_path = swagger_ui_3_path
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Kept v3 as default for now to limit impact of change.
But since a major version update is needed anyway, we might want to change it to v4 already.

@RobbeSneyders
Copy link
Member Author

Hi @dtkav, replying to spec-first/connexion#1429 (comment) here:

I saw you had a pull request to update to swagger UI v4. I have very little free time at the moment, sorry for not getting back to you.
FYI the release process is a little bit more complicated than copying the distributable binaries from upstream because there is a jinja template that is used to inject some settings from connexion.

No worries about getting back, this isn't urgent. I was just testing a connexion issue with a newer version of the UI and saw the open issue #20 on this repo.

The only jinja templating I could find, was in index.j2, which I included for v4 as well. Let me know if there is something I missed.

@aiman-alsari
Copy link

Can we get this merged please? Even the swagger v3.52.0 that is currently there has open CVEs.

@RobbeSneyders
Copy link
Member Author

@dtkav you once proposed to donate this repository to the spec-first organization as well. Happy to support it there if this is still something you want.

@sanjaypandana
Copy link

sanjaypandana commented Mar 23, 2022

Hello @RobbeSneyders ,
Is this PR a fix for https://nvd.nist.gov/vuln/detail/CVE-2019-17495 ?
Currently I am blocked by security signing off on any deployments due to this vulnerability.
Any ETA on this ?

@RobbeSneyders
Copy link
Member Author

@dtkav any update on this PR or on moving the repository to spec-first?

@aiman-alsari
Copy link

I have given up on this project and am now pointing connexion to an upgraded swagger-ui dist directory that I have checked in to my repo.

@bartsanchez
Copy link

FYI: since looks like there's no more activity on this project (seems abandoned) I've forked it and added support for version 4 (and removed support for versions 2 and 3) there: https://github.com/bartsanchez/swagger_ui_bundle

Maybe you could find it useful.

@RobbeSneyders
Copy link
Member Author

Merged in #32

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2019-17495 for swagger-ui
4 participants