Latest Threat Research:Malicious dYdX Packages Published to npm and PyPI After Maintainer Compromise.Details
Socket
Book a DemoInstallSign in
Socket

@hey-api/json-schema-ref-parser

Package Overview
Dependencies
Maintainers
1
Versions
24
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@hey-api/json-schema-ref-parser

Parse, Resolve, and Dereference JSON Schema $ref pointers

Source
npmnpm
Version
0.0.0-next-20260213013734
Version published
Weekly downloads
1.3M
18.88%
Maintainers
1
Weekly downloads
 
Created
Source

JSON Schema $Ref Parser

Parse, Resolve, and Dereference JSON Schema $ref pointers

Installation

Install using npm:

npm install @hey-api/json-schema-ref-parser
yarn add @hey-api/json-schema-ref-parser
bun add @hey-api/json-schema-ref-parser

The Problem:

You've got a JSON Schema with $ref pointers to other files and/or URLs. Maybe you know all the referenced files ahead of time. Maybe you don't. Maybe some are local files, and others are remote URLs. Maybe they are a mix of JSON and YAML format. Maybe some of the files contain cross-references to each other.

{
  "definitions": {
    "person": {
      // references an external file
      "$ref": "schemas/people/Bruce-Wayne.json"
    },
    "place": {
      // references a sub-schema in an external file
      "$ref": "schemas/places.yaml#/definitions/Gotham-City"
    },
    "thing": {
      // references a URL
      "$ref": "http://wayne-enterprises.com/things/batmobile"
    },
    "color": {
      // references a value in an external file via an internal reference
      "$ref": "#/definitions/thing/properties/colors/black-as-the-night"
    }
  }
}

The Solution:

JSON Schema $Ref Parser is a full JSON Reference and JSON Pointer implementation that crawls even the most complex JSON Schemas and gives you simple, straightforward JavaScript objects.

  • Use JSON or YAML schemas — or even a mix of both!
  • Supports $ref pointers to external files and URLs, as well as custom sources such as databases
  • Can bundle multiple files into a single schema that only has internal $ref pointers
  • Can dereference your schema, producing a plain-old JavaScript object that's easy to work with
  • Supports circular references, nested references, back-references, and cross-references between files
  • Maintains object reference equality — $ref pointers to the same value always resolve to the same object instance
  • Compatible with Node LTS and beyond, and all major web browsers on Windows, Mac, and Linux

New in this fork (@hey-api)

  • Multiple inputs with bundleMany: Merge and bundle several OpenAPI/JSON Schema inputs (files, URLs, or raw objects) into a single schema. Components are prefixed to avoid name collisions, paths are namespaced on conflict, and $refs are rewritten accordingly.
import { $RefParser } from '@hey-api/json-schema-ref-parser';

const parser = new $RefParser();
const merged = await parser.bundleMany({
  pathOrUrlOrSchemas: [
    './specs/a.yaml',
    'https://example.com/b.yaml',
    { openapi: '3.1.0', info: { title: 'Inline' }, paths: {} },
  ],
});

// merged.components.* will contain prefixed names like a_<name>, b_<name>, etc.
  • Dereference hooks: Fine-tune dereferencing with excludedPathMatcher(path) => boolean to skip subpaths and onDereference(path, value, parent, parentPropName) to observe replacements.
const parser = new $RefParser();
parser.options.dereference.excludedPathMatcher = (p) => p.includes('/example/');
parser.options.dereference.onDereference = (p, v) => {
  // inspect p / v as needed
};
await parser.dereference({ pathOrUrlOrSchema: './openapi.yaml' });
  • Smart input resolution: You can pass a file path, URL, or raw schema object. If a raw schema includes $id, it is used as the base URL for resolving relative $refs.
await new $RefParser().bundle({
  pathOrUrlOrSchema: {
    $id: 'https://api.example.com/openapi.json',
    openapi: '3.1.0',
    paths: {
      '/ping': { get: { responses: { 200: { description: 'ok' } } } },
    },
  },
});

Keywords

$ref

FAQs

Package last updated on 13 Feb 2026

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts