Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@stoplight/spectral
Advanced tools
A flexible object linter with out of the box support for OpenAPI v2 and v3.
A flexible JSON object linter with out of the box support for OpenAPI v2 and v3
npm install @stoplight/spectral
npm install -g @stoplight/spectral
Supports Node v8.3+.
For users without Node and/or NPM/Yarn, we provide standalone packages for all major platforms. We also provide a shell script to auto download the executable based on your operating system:
curl -L https://raw.githack.com/stoplightio/spectral/master/install.sh | sh
Note, the binaries are not auto-updatable, therefore you will need to download a new version on your own.
sudo mv ./spectral-linux /usr/local/bin/spectral
You may need to restart your terminal.
Now, spectral
command will be accessible in your terminal.
Head over to releases for the latest binaries.
docker run --rm -it stoplight/spectral lint "${URL}"`
Spectral can be run via the command-line:
spectral lint petstore.yaml
Other options include:
-c, --config=config path to a config file
-e, --encoding=encoding text encoding to use
-f, --format=json|stylish formatter to use for outputting results
-h, --help show CLI help
-m, --maxResults=maxResults deprecated: use --max-results instead
-o, --output=output output to a file instead of stdout
-q, --quiet no logging - output only
-r, --ruleset=ruleset path to a ruleset file (supports remote files)
-s, --skip-rule=skip-rule ignore certain rules if they are causing trouble
-v, --verbose increase verbosity
--max-results=max-results [default: all] maximum results to show
Note: The Spectral CLI supports both YAML and JSON.
Currently, Spectral CLI CLI supports validation of OpenAPI documents and lints them based on our default ruleset, or you can provide your own rulesets.
There are three key concepts in Spectral: Rulesets, Rules and Functions.
Think of a set of rules and functions as a flexible and customizable style guide for your JSON objects.
Spectral CLI supports config files, to avoid typing out CLI options and arguments every single time.
Spectral is written in TypeScript (JavaScript) and can be used directly for when you need to use Spectral programmatically. Take a look at our "JavaScript API documentation".
How is this different than Ajv?
Ajv is a JSON Schema validator, not a linter. Spectral does expose a schema
function that you can use in your rules to validate all or part of the target object with JSON Schema (Ajv is used under the hood). However, Spectral also provides a number of other functions and utilities that you can use to build up a linting ruleset to validates things that JSON Schema is not well suited for.
I want to lint my OpenAPI documents but don't want to implement Spectral right now.
No problem! A hosted version of Spectral comes free with the Stoplight platform. Sign up for a free account here.
What is the difference between Spectral and Speccy?
With Spectral, lint rules can be applied to any JSON object. Speccy is designed to work with OpenAPI v3 only. The rule structure is different between the two. Spectral uses JSONPath path
parameters instead of the object
parameters (which are OpenAPI specific). Rules are also more clearly defined (thanks to TypeScript typings) and now require specifying a type
parameter. Some rule types have been enhanced to be a little more flexible along with being able to create your own rules based on the built-in and custom functions.
If you are interested in contributing to Spectral itself, check out our contributing docs to get started.
Also, most of the interesting projects are built with Spectral. Please consider using Spectral in a project or contribute to an existing one.
If you are using Spectral in your project and want to be listed in the examples section, we encourage you to open an issue.
path
you wantgetJsonPathForPosition
or getLocationForJsonPath
If you have a bug or feature request, please open an issue here.
If you need help using Spectral or have a support question, please use the Stoplight Community forum. We've created an open source category for these questions. It's also a great place to share your implementations.
If you want to discuss something in private, you can reach out to Stoplight support at support@stoplight.io.
FAQs
[![Demo of Spectral linting an OpenAPI document from the CLI](./docs/img/readme-header.svg)](https://stoplight.io/api-governance?utm_source=github&utm_medium=spectral&utm_campaign=readme) [![CircleCI](https://img.shields.io/circleci/build/github/stoplight
The npm package @stoplight/spectral receives a total of 26,727 weekly downloads. As such, @stoplight/spectral popularity was classified as popular.
We found that @stoplight/spectral demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 34 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.