{"record":{"id":"974ab6caff9a12b4","repo":"grpc-ecosystem/grpc-gateway","slug":"s-security-w","errorCode":null,"errorMessage":"%s: security: %w","messagePattern":"(.+?): security: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"openapiv3-merge/internal/merge/merge.go","lineNumber":232,"sourceCode":"\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"%s: paths: %w\", in.Name, err)\n\t\t\t}\n\t\t\td.Paths = obj\n\t\tcase \"webhooks\":\n\t\t\tobj, err := decodeOrderedObject(raw)\n\t\t\tif err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"%s: webhooks: %w\", in.Name, err)\n\t\t\t}\n\t\t\td.Webhooks = obj\n\t\tcase \"components\":\n\t\t\tif !isJSONNull(raw) {\n\t\t\t\tif err := json.Unmarshal(raw, d.Components); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"%s: components: %w\", in.Name, err)\n\t\t\t\t}\n\t\t\t}\n\t\tcase \"security\":\n\t\t\tif err := json.Unmarshal(raw, &d.Security); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"%s: security: %w\", in.Name, err)\n\t\t\t}\n\t\tcase \"tags\":\n\t\t\tif err := json.Unmarshal(raw, &d.Tags); err != nil {\n\t\t\t\treturn nil, fmt.Errorf(\"%s: tags: %w\", in.Name, err)\n\t\t\t}\n\t\tcase \"externalDocs\":\n\t\t\td.ExternalDocs = raw\n\t\tdefault:\n\t\t\td.extras.set(key, raw)\n\t\t}\n\t}\n\tif _, err := dec.Token(); err != nil {\n\t\treturn nil, fmt.Errorf(\"%s: %w\", in.Name, err)\n\t}\n\tif d.OpenAPI == \"\" {\n\t\treturn nil, fmt.Errorf(\"%s: missing required field \\\"openapi\\\"\", in.Name)\n\t}\n\tif isJSONNull(d.Info) {","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/grpc-ecosystem/grpc-gateway/blob/a58a4436a376a4bcc7d8f10c4d4f919a8438bba9/openapiv3-merge/internal/merge/merge.go#L214-L250","documentation":"This error is returned when the top-level `security` field of an input document cannot be json.Unmarshal-ed into the library's security slice type. The OpenAPI `security` field must be a JSON array of security requirement objects (e.g. [{\"apiKey\": []}]), so strings, objects, numbers, or null fail and are wrapped as `<name>: security: <cause>`.","triggerScenarios":"Calling Merge with an Input whose Data contains `\"security\": \"basicAuth\"` (string), `\"security\": {\"apiKey\": []}` (bare object instead of array of objects), `\"security\": null`, or any non-array value under `security`.","commonSituations":"Hand-written specs where a single requirement object was written without the surrounding array; specs copied from OpenAPI 2.0 `securityDefinitions` usage; generated specs where Security was a map or string rather than a slice; templates with placeholder text under security.","solutions":["Edit the input so `security` is an array of requirement objects, e.g. \"security\": [{\"apiKey\": []}].","If a single requirement applies, wrap it: {\"apiKey\": []} becomes [{\"apiKey\": []}].","If no global security applies, omit the key entirely (or use [] for an explicitly unsecured document).","Pre-validate by unmarshalling the `security` value into []map[string][]string before calling Merge."],"exampleFix":"// before\n{\"openapi\": \"3.1.0\", \"security\": {\"apiKey\": []}}\n// after\n{\"openapi\": \"3.1.0\", \"security\": [{\"apiKey\": []}]}","handlingStrategy":"validation","validationCode":"func validateSecurityField(data []byte) error {\n\tvar doc struct {\n\t\tSecurity json.RawMessage `json:\"security\"`\n\t}\n\tif err := json.Unmarshal(data, &doc); err != nil {\n\t\treturn err\n\t}\n\tif len(doc.Security) == 0 || string(doc.Security) == \"null\" {\n\t\treturn nil\n\t}\n\tvar s []map[string][]string\n\tif err := json.Unmarshal(doc.Security, &s); err != nil {\n\t\treturn fmt.Errorf(\"security must be an array of requirement objects: %w\", err)\n\t}\n\treturn nil\n}","typeGuard":"func isSecurityArray(raw json.RawMessage) bool {\n\tvar s []map[string][]string\n\treturn len(raw) > 0 && json.Unmarshal(raw, &s) == nil\n}","tryCatchPattern":"merged, err := merger.Merge(inputs)\nif err != nil {\n\tif strings.Contains(err.Error(), \": security: \") {\n\t\treturn fmt.Errorf(\"input spec has a malformed security field: %w\", err)\n\t}\n\treturn err\n}","preventionTips":["Always write security as an array, even for a single requirement: [{\"apiKey\": []}].","When generating specs, use a slice type for Security so it marshals correctly.","Omit the security key entirely when no global security requirements apply.","Validate specs against the OpenAPI 3.x JSON Schema before merging."],"tags":["json","openapi","type-mismatch","parsing"],"backgroundTag":"json-unmarshal-type-error","analyzedSha":"a58a4436a376a4bcc7d8f10c4d4f919a8438bba9","analyzedAt":"2026-09-02T10:28:31.537Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-09T16:17:10.729Z"}