refactor: remove swag v1 dependency, use swag/v2 exclusively#146
Open
AndriyKalashnykov wants to merge 1 commit intoswaggo:masterfrom
Open
refactor: remove swag v1 dependency, use swag/v2 exclusively#146AndriyKalashnykov wants to merge 1 commit intoswaggo:masterfrom
AndriyKalashnykov wants to merge 1 commit intoswaggo:masterfrom
Conversation
Replace all imports of github.com/swaggo/swag (v1) with github.com/swaggo/swag/v2 in both EchoWrapHandler and EchoWrapHandlerV3. Both handlers now use the same v2 registry. This eliminates the transitive swag v1 dependency that consumers of echo-swagger/v2 were forced to carry in their go.mod. Changes: - swagger.go: remove swag v1 import, use swag/v2 for ReadDoc/Name - swagger_test.go: remove swag v1 import, fix double-registration panic (both handlers now share the v2 registry) - go.mod: remove github.com/swaggo/swag, bump swag/v2 to v2.0.0-rc5, bump echo/v5 to v5.0.3 (fixes GO-2026-4502 path traversal CVE) Relates to swaggo#126, swaggo#147
AndriyKalashnykov
force-pushed
the
remove-swag-v1-dependency
branch
from
1eb310f to
33574a7
Compare
AndriyKalashnykov
pushed a commit
to AndriyKalashnykov/flight-path
that referenced
this pull request
Apr 6, 2026
Add swaggo/echo-swagger#146 and #147 to session-checked upgrade tracking items so we pick up the fix when merged upstream.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
echo-swagger/v2currently depends on bothgithub.com/swaggo/swag(v1) andgithub.com/swaggo/swag/v2. This forces every consumer ofecho-swagger/v2to carryswag v1as an indirect dependency in theirgo.mod, even when they only useEchoWrapHandlerV3(which already uses swag v2 internally).This PR removes the
swag v1dependency entirely by migratingEchoWrapHandlerto useswag/v2as well. It also bumpsecho/v5from v5.0.0 to v5.0.3 to fix a known path traversal vulnerability (GO-2026-4502).Changes
swagger.go: Replace"github.com/swaggo/swag"import with"github.com/swaggo/swag/v2". BothReadDoc()andNamehave identical APIs in v2 — this is a drop-in replacement. Remove theswagV2alias since only one swag import remains.swagger_test.go: Removeswag v1import. Since both handlers now share the v2 registry, remove the duplicateswag.Register()call inTestWrapHandlerV3(the doc is already registered byTestWrapHandler).go.mod: Removegithub.com/swaggo/swag v1.16.2, bumpswag/v2tov2.0.0-rc5, bumpecho/v5tov5.0.3(fixes GO-2026-4502).Security fix
Echo v5.0.0 (previously pinned) has GO-2026-4502: a Windows path traversal vulnerability via backslash in
middleware.Staticdefault filesystem. Fixed in v5.0.3. This PR bumps to v5.0.3 to resolve the Snyk finding.Before / After
Before (
go.modof a consumer):```
require github.com/swaggo/echo-swagger/v2 v2.0.1
require (
github.com/swaggo/swag v1.16.6 // indirect — unwanted
github.com/swaggo/swag/v2 v2.0.0-rc5 // indirect
)
```
After:
```
require github.com/swaggo/echo-swagger/v2 v2.0.2 // hypothetical
require (
github.com/swaggo/swag/v2 v2.0.0-rc5 // indirect — only v2
)
```
Test results
All 16 existing tests pass.
govulncheckreports zero vulnerabilities.Relates to #126, #147