🐛 [Bug]: swaggerui depends on vulnerable gopkg.in/yaml.v2 v2.4.0 (CVE-2022-28948)

[milenabruseva]

Bug Description

github.com/gofiber/contrib/v3/swaggerui directly depends on gopkg.in/yaml.v2 v2.4.0, which is flagged for CVE-2022-28948, a denial-of-service in yaml.Unmarshal triggered by malformed input.

The vulnerability will not be patched upstream: gopkg.in/yaml.v2 is in maintenance-only mode and v2.4.0 is its terminal release. The fix only exists in gopkg.in/yaml.v3 (v3.0.0+).

The dependency is used in a single location, swaggerui/swagger.go:127:

  import "gopkg.in/yaml.v2"
  ...
  var yamlData map[string]interface{}
  errYAML := yaml.Unmarshal(rawSpec, &yamlData)

It unmarshals a Swagger spec provided via FilePath / FileContent into a generic map. Since the spec content can come from disk or arbitrary bytes the user passes in, malformed input could crash the host process.

yaml.v3 is already in the module's transitive dependency graph (via go-openapi), so promoting it to a direct dep and dropping v2 is a self-contained change. The Unmarshal signature is identical between v2 and v3.

How to Reproduce

1. Create a new Go module that depends on github.com/gofiber/contrib/v3/swaggerui v1.0.6.
2. Run go mod graph | grep yaml.v2.
3. Observe gopkg.in/yaml.v2@v2.4.0 in the dependency graph.
4. Run any SCA scanner (Trivy, Grype, BlackDuck, Snyk, GitHub Dependabot) against the module — CVE-2022-28948 is reported as HIGH severity.

Expected Behavior

swaggerui should not pull in gopkg.in/yaml.v2. It should use gopkg.in/yaml.v3 (which already exists in the transitive graph), so that downstream consumers are not flagged for CVE-2022-28948.

Contrib package Version

v1.0.6

Code Snippet (optional)

Checklist:

• I agree to follow Fiber's Code of Conduct.
• I have checked for existing issues that describe my problem prior to opening this one.
• I understand that improperly formatted bug reports may be closed without explanation.

[coderabbitai]

🔗 Related PRs

#1304 - feat: Make Swagger CDN assets configurable [merged]
gofiber/swagger#115 - chore: align workflows with Go 1.25 [closed]
#1444 - introduce swaggo and rename swagger to swaggerui [merged]
gofiber/cli#226 - Add migrator for swagger packages [merged]
gofiber/cli#246 - Fix swagger package migration targets [merged]

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!