json-schema-secure.json fails strict type validation in v7

[aarongoldenthal]

What version of Ajv are you using? Does the issue happen if you use the latest version?

v7.0.2

JSON Schema

The schema in /lib/refs/json-schema-secure.json fails strict type validation in v7 and return the following errors when running a security check as documented at https://github.com/ajv-validator/ajv/blob/master/docs/security.md#security-risks-of-trusted-schemas:

strict mode: missing type "object" for keyword "dependencies" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#" (strictTypes)
strict mode: missing type "object" for keyword "properties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#" (strictTypes)
strict mode: missing type "object" for keyword "required" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/patternProperties" (strictTypes)
strict mode: missing type "object" for keyword "properties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/patternProperties" (strictTypes)
strict mode: missing type "object" for keyword "required" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/patternProperties/properties/propertyNames" (strictTypes)
strict mode: missing type "object" for keyword "properties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/uniqueItems/if" (strictTypes)
strict mode: missing type "object" for keyword "properties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/uniqueItems/if/properties/items" (strictTypes)
strict mode: missing type "object" for keyword "required" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/uniqueItems/then" (strictTypes)
strict mode: missing type "object" for keyword "required" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/pattern" (strictTypes)
strict mode: missing type "object" for keyword "required" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/dependencies/format" (strictTypes)
strict mode: missing type "object" for keyword "additionalProperties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/properties/dependencies" (strictTypes)
strict mode: missing type "object" for keyword "additionalProperties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/properties/definitions" (strictTypes)
strict mode: missing type "object" for keyword "additionalProperties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/properties/patternProperties" (strictTypes)
strict mode: missing type "object" for keyword "additionalProperties" at "https://raw.githubusercontent.com/ajv-validator/ajv/master/lib/refs/json-schema-secure.json#/properties/properties" (strictTypes)

This can be worked around by using strictTypes: false.

[epoberezkin]

Thank you! This schema needs to be updated to be compatible with the strict mode. For now - you need to disable strict mode (with {strict: false}) to use it.

[epoberezkin]

or maybe even {strictTypes: false} would be sufficient to suppress these warnings

[epoberezkin]

Actually, this schema should be used with strictTypes: false, there is nothing that needs to be changed other than maybe the note in the docs (added). The reason for that is that a schema can be a boolean value.

Also, for draft-2019-09 a more concise version of this schema can be created using recursive references, that would also validate schema against draft-2019-09 meta-schema.

[aarongoldenthal]

Thanks for the clarification @epoberezkin

[javierguzman]

strict: false

Hello @epoberezkin , is there a page or source where I could take a look at how to update "an old schema" to the new way of doing things (strict mode)? I did not update my project for a while and now I have update ajv I am getting a ton of errors like the one reported here.

Thank you in advance and regards