// the find
APIDevTools/swagger-parser
Swagger 2.0 and OpenAPI 3.0 parser/validator
A JavaScript library for parsing, validating, and dereferencing Swagger 2.0 and OpenAPI 3.0 specs. It handles the nasty parts of working with OpenAPI — circular $refs, cross-file references, bundling multi-file specs into one — and runs in both Node and browsers. If you're building tooling around OpenAPI specs, this is the de facto starting point.
Tested against 1,500+ real-world APIs from APIs.guru, which means edge cases you'd never think to write tests for are already covered. The $ref resolution is genuinely good — it handles circular references, nested refs, and cross-file refs without choking, and preserves object identity so the same $ref always resolves to the same instance. The bundle/dereference distinction is useful: bundle keeps $refs internal (good for distribution), dereference expands everything to a plain object (good for code generation). Works in browser without a Node.js shim layer, which most comparable tools don't bother with.
OpenAPI 3.1 support is absent — it's not even on the roadmap in the README. OAS 3.1 has been out since 2021 and adoption is growing; this is a real gap if you're working with modern specs. The LFI risk documented in SECURITY.md is worth flagging: by default it'll resolve any $ref path including local filesystem paths, which is a footgun if you're parsing user-supplied specs without sandboxing. The project is under the APIDevTools org which was acquired by SmartBear; maintenance cadence has slowed and the dependency on the abandoned david-dm badge tool suggests the README hasn't been touched in years. No streaming or incremental parsing — it loads the whole spec into memory, which becomes a problem with very large specs (some real-world ones exceed 10MB).