Regression in Vacuum OpenAPI report

TLDR;

It is most likely cause by upgrading SmallRye OpenAPI plugin in 0987efd5 from 3.10.0 to 4.3.5, which now generates empty "schema" : { } for undefined response types, and vacuum is picky about it:

        "responses" : {
          "200" : {
            "description" : "OK",
            "content" : {
              "application/json" : {
                "schema" : { }
              }
            }
          }
        },

What steps does it take to reproduce the issue?

I just did a quick check of the OpenAPI vacuum tests, which we used earlier to see how much we improved the OpenAPI definitions in this PR #12439.

There we reached 98/100 A+ score. Now I ran the exact same test with the same vacuum config:

description: Dataverse OpenAPI recommended rules with legacy/noisy rules disabled.
extends: [[vacuum:oas, recommended]]
rules:
  # Endpoint paths are historically camel case, and we won't change those for OpenAPI conformance
  paths-kebab-case: false
  # We do have duplications, because the same parameters as `id` will be used in multiple endpoints
  description-duplication: false
  # We don't have examples
  oas3-missing-example: false
  # We have /pids/{id}/delete --> see edu.harvard.iq.dataverse.api.Pids#deletePid
  # The HTTP verb there is DELETE so actually we don't need to have the verb in the path,
  #  could be fixed
  no-http-verbs-in-path: false
  # These endpoints have an unused `body` parameter, probably because of copy-paste.
  # no-request-body: false would not report them, but rather we should fix them to remove `body`
  # GET /files/{id}/prov-freeform
  # GET /files/{id}/prov-json
  # GET /files/{id}/prov-json
  #no-request-body: false

> vacuum lint -r ~/tmp/dvvacuum.yaml 'https://beta.dataverse.org/openapi?format=json'
    
 ██╗   ██╗ █████╗  ██████╗██╗   ██╗██╗   ██╗███╗   ███╗ 《《《─═─═── ·* · ˙*
 ██║   ██║██╔══██╗██╔════╝██║   ██║██║   ██║████╗ ████║《《《──═─═──· ··* ˙˙
 ██║   ██║███████║██║     ██║   ██║██║   ██║██╔████╔██║《《《───═─═─··· ˙˙ ˙
 ╚██╗ ██╔╝██╔══██║██║     ██║   ██║██║   ██║██║╚██╔╝██║《《──═─═──·* ·· ˙˙
  ╚████╔╝ ██║  ██║╚██████╗╚██████╔╝╚██████╔╝██║ ╚═╝ ██║ 《《─═─═──* · · ˙
   ╚═══╝  ╚═╝  ╚═╝ ╚═════╝ ╚═════╝  ╚═════╝ ╚═╝     ╚═╝ 《───═─═─· ··* ˙˙ ˙

 version: 0.29.2 | compiled: Sat, 06 Jun 2026 09:45:50 UTC
 https://quobix.com/vacuum/ | https://github.com/daveshanley/vacuum

 using ruleset '/Users/balazs/tmp/dvvacuum.yaml' (containing 51 rules)
 vacuuming file 'https://beta.dataverse.org/openapi?format=json' against 51 rules: https://quobix.com/vacuum/rulesets/recommended

 category              ✗ errors      ▲ warnings    ● info                                                  
 ────────────────────  ────────────  ────────────  ────────────────────────────────────────────────────────
 Operations            0             4             0                                                       
 Tags                  0             1             0                                                       
 Schemas               0             0             86                                                      
 Validation            0             1             0                                                       
 Descriptions          0             2             0                                                       
 ────────────────────  ────────────  ────────────  ────────────────────────────────────────────────────────
 total                 0             8             86                                                      

 rule                                      violations    quality impact                                    
 ────────────────────────────────────────  ────────────  ──────────────────────────────────────────────────
 oas-missing-type                          86            ██████████████████████████████████████████████████
 no-request-body                           4             ██                                                
 oas3-parameter-description                2             █                                                 
 oas3-api-servers                          1             █                                                 
 operation-tags                            1             █                                                 
 ────────────────────────────────────────  ────────────  ──────────────────────────────────────────────────
 total                                     94          

 --> use the <dashboard> command to be able to navigate results interactively <--

┌─────────────────────────────────────────────────────────────────────────────────────────────────────────┐
│                                                                                                         │
│  Quality Score: 89/100 [B]                                                                              │
│                                                                                                         │
└─────────────────────────────────────────────────────────────────────────────────────────────────────────┘

 │                                               
 │ ▲ Passed, but with 8 warnings and 86 informs. 

The score when back to 89/100 because of 86 new oas-missing-type problems.

I retested the version the PR #12439 was based on and the score there with the same vacuum config was still 98/100

I also checked that the OpenAPI annotations didn't change between my PR and the current version. The problamatic endpoints are all returning opaque Response objects like here:

    @GET
    @Path("/exportAll")
    @Produces("application/json")
    @Operation(summary = "Starts metadata export jobs",
            description = "Starts background exports for published local datasets that have not been exported since their last publication.")
    public Response exportAll() {
        datasetService.exportAllAsync();
        return this.accepted();
    }

It is most likely cause by upgrading SmallRye OpenAPI plugin in 0987efd5 from 3.10.0 to 4.3.5, which now generates empty "schema" : { } for undefined response types, and vacuum is picky about it:

        "responses" : {
          "200" : {
            "description" : "OK",
            "content" : {
              "application/json" : {
                "schema" : { }
              }
            }
          }
        },

Are you thinking about creating a pull request for this issue?

I see two solutions:

1. If we don't need any new features of SmallRye OpenAPI generator we can go back to 3.10.0 from 4.3.5. (or maybe the latest 3.X version?) @qqmyers ?
2. The systematic solution would be, of course, if all these endpoints returned a definite Java DTO with the result, but I don't see that would happen
3. Maybe we could use some AI help again to discover these handwritten JSONs (or CSV) that are actually embedded in these Responses.

Start by comparing the generated OpenAPI output before and after the SmallRye OpenAPI upgrade from 3.10.0 to 4.3.5, then inspect endpoints returning opaque Java Response objects such as exportAll(). Use the existing vacuum command and configuration to verify the fix; done means the empty schemas and resulting oas-missing-type violations are resolved and the quality score returns to the earlier 98/100.