deps: bump com.networknt:json-schema-validator from 1.4.3 to 2.0.8

[dependabot]

Bumps com.networknt:json-schema-validator from 1.4.3 to 2.0.8.

Release notes

Sourced from com.networknt:json-schema-validator's releases.

2.0.8- 2026-10-01

Added

Changed

• Resolve the OpenAPI nullable keyword through allOf/oneOf/anyOf, if/then/else and $ref/$dynamicRef/$recursiveRef ancestors, to any depth and in any order. nullable on a schema composed through these keywords now applies to the value they describe, for both the type and enum keywords.
• nullable on a container no longer applies to the values described by its properties, items and additionalProperties subschemas. Previously a nullable container made an inline (non-$ref) child accept null. Schemas relying on that must declare nullable on the child itself.
• oneOf no longer requires exactly one matching branch when the value is null and a nullable ancestor permits it. Every branch accepts null in that case, so {"nullable": true, "oneOf": [ ... ]} previously reported that more than one branch matched. Branch errors are still reported when no branch matches.
• nullable no longer applies inside a not subschema, so {"nullable": true, "not": {"type": "string"}} now accepts null where it previously reported a not error.
• With typeLoose enabled, the string "null" no longer satisfies an enum on a nullable schema. {"enum": ["a"], "nullable": true} previously accepted the string "null" as well as an actual null; only an actual null is accepted now.

2.0.7- 2026-08-20

Added

Changed

• Preserve binary compatibility for the Error constructor after adding custom-message metadata.

GitHub tag correction: this tag previously pointed to a 3.x commit on master. It now points to the verified 2.x release commit ae64ed637f743c4a88b2a391f20b639fe7f7d8e3, whose POM and all 222 published Java source files match Maven Central. The published Maven artifacts were already correct.

2.0.6- 2026-08-20

Added

• Add Error.isCustomMessage() to identify schema-supplied validation messages.

Changed

Restored missing GitHub tag and release. The release commit was verified against the existing Maven Central POM and all 222 published Java source files.

2.0.5- 2026-08-20

Added

Changed

• upgrade jackson to 2.22.1 to resolve a security vulnerability

GitHub tag correction: this tag previously pointed to a 3.x commit on master. It now points to the verified 2.x release commit 1fedf7133bb9ba4b41c7e3575abea01a6d5b61d0, whose POM and all 222 published Java source files match Maven Central. The published Maven artifacts were already correct.

2.0.4- 2026-07-07

Added

Changed

• Fall back to the library class loader for classpath resources (#1266) Thanks @​joaodinissf

... (truncated)

Changelog

Sourced from com.networknt:json-schema-validator's changelog.

Change Log

All notable changes to this project will be documented in this file.

This format is based on Keep a Changelog.

This project does not adhere to Semantic Versioning and minor version changes can have incompatible API changes. These incompatible API changes will largely affect those who have custom validator or walker implementations. Those who just use the library to validate using the standard JSON Schema Draft specifications may not need changes.

[Unreleased]

Added

Changed

2.0.8- 2026-10-01

Added

Changed

• Resolve the OpenAPI nullable keyword through allOf/oneOf/anyOf, if/then/else and $ref/$dynamicRef/$recursiveRef ancestors, to any depth and in any order. nullable on a schema composed through these keywords now applies to the value they describe, for both the type and enum keywords.
• nullable on a container no longer applies to the values described by its properties, items and additionalProperties subschemas. Previously a nullable container made an inline (non-$ref) child accept null. Schemas relying on that must declare nullable on the child itself.
• oneOf no longer requires exactly one matching branch when the value is null and a nullable ancestor permits it. Every branch accepts null in that case, so {"nullable": true, "oneOf": [ ... ]} previously reported that more than one branch matched. Branch errors are still reported when no branch matches.
• nullable no longer applies inside a not subschema, so {"nullable": true, "not": {"type": "string"}} now accepts null where it previously reported a not error.
• With typeLoose enabled, the string "null" no longer satisfies an enum on a nullable schema. {"enum": ["a"], "nullable": true} previously accepted the string "null" as well as an actual null; only an actual null is accepted now.

2.0.7- 2026-08-20

Added

Changed

• Preserve binary compatibility for the Error constructor after adding custom-message metadata.

2.0.6- 2026-08-20

Added

• Add Error.isCustomMessage() to identify schema-supplied validation messages.

Changed

2.0.5- 2026-08-20

Added

Changed

• upgrade jackson to 2.22.1 to resolve a security vulnerability

... (truncated)

Commits

• 0913d12 update the changelog
• 21d9413 upgrade to 2.0.8 and update changelog
• 7522c5b Port fix of nullable allof ref type check to the 2.x branch (#1280)
• ae64ed6 upgrade to 2.0.7 and update changelog
• 2debf80 preserve Error constructor binary compatibility
• 18da44a add custom error message accessor and release 2.0.6
• 1fedf71 upgrade to 2.0.5 and update changelog
• 9992c87 upgrade jackson to 2.22.1 to resolve a security vulnerability
• 2ad2529 upgrade to 2.0.4 and update changelog
• d6d8e35 Fall back to the library class loader for classpath resources (#1266)
• Additional commits viewable in compare view

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
com.networknt:json-schema-validator	[>= 3.a0, < 4]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)