Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Consider replacing oas-tools library as it appears abandoned #12

Open
mikelax opened this issue Dec 27, 2021 · 2 comments
Open

Consider replacing oas-tools library as it appears abandoned #12

mikelax opened this issue Dec 27, 2021 · 2 comments
Labels
dependencies Pull requests that update a dependency file question Further information is requested

Comments

@mikelax
Copy link
Collaborator

mikelax commented Dec 27, 2021

Feature Overview

The Usher currently using the library oas-tools to perform various validations and quality-of-life improvements for taking an API First approach to application building. Unfortunately, it appears the library has been abandoned. The last release was over two years ago, and there are numerous security CVEs identified in it's dependencies that are not being addressed.

We should consider replacing oas-tools with a newer library, that is currently supported. Within the express ecosystem, I found express-openapi-validator, which appears to perform the same functions we are using from oas-tools.

✅ Request/Response Validation
✅ Security Middleware Validation
✅ Automatic mapping of Open API functions to express functions

Describe the solution you'd like
After reading over the project's readme, it seems it would be a fairly limited change to replace the libraries.
Small code updates in the main the-usher.js server set up, and replacing vendor extensions in the open api yaml file for the function mapping.

Additional context

Add any other context or screenshots about the feature request here.

@mikelax mikelax added enhancement New feature or request question Further information is requested labels Dec 27, 2021
@mikelax
Copy link
Collaborator Author

mikelax commented Mar 3, 2022

It's still worth considering if we should switch, but they did finally publish a new version in early March.

@mikelax
Copy link
Collaborator Author

mikelax commented Nov 14, 2022

The package has been getting support through 2022, with a major v3 release.
Here is the migration guide to update from v2 to v3.

As another datapoint, here are the npm trends for the two libraries.

@mikelax mikelax added dependencies Pull requests that update a dependency file and removed enhancement New feature or request labels Jan 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file question Further information is requested
Projects
None yet
Development

No branches or pull requests

1 participant