[BUG] — `AiResponseTransformerPlugin`: `new ObjectMapper()` per response (two sites)
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
- severity: High
- files: `shenyu-plugin-ai/shenyu-plugin-ai-response-transformer/.../AiResponseTransformerPlugin.java:220` (`new ObjectMapper().readTree(body)` inside `extractJsonBodyFromAiResponse`, per response) and `:337` (`ObjectMapper objectMapper = new ObjectMapper()` inside `writeWith`'s `flatMap`, per response)
- description: `writeWith` runs on every decorated response body when the ai-response-transformer plugin is active; `new ObjectMapper()` builds a fresh TypeFactory/SerializerProvider each call. Sibling `AiTokenLimiterPlugin.java:196` correctly hoists a static `MAPPER`.
- impact: Per-response ObjectMapper construction on every AI-transformed response; CPU + young-gen pressure under load.
- suggested_fix: Hoist `private static final ObjectMapper MAPPER = new ObjectMapper();` (reuse sibling pattern).
- confidence: High
- related_existing: PERF-22 covers `McpServerPlugin.java:710` + `MessageHandlingResult.java:93`; these are different files/classes.
---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/00-consolidated-critical-high.md`](docs/scan2-2026-08-02/00-consolidated-critical-high.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Read AiResponseTransformerPlugin.java around lines 220 and 337, then compare the static MAPPER pattern in AiTokenLimiterPlugin.java:196. Verify both response-processing sites use the shared mapper rather than constructing one per response, and check the affected plugin tests or build target if available.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, performance
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 84/100