Repository navigation
fix(deps): update module github.com/oapi-codegen/runtime to v1.8.0 - #170
Open
renovate[bot] wants to merge 1 commit into
Open
renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
Member
✅ All CI Checks PassedAll checks have passed successfully. Thank you for contributing to the project ✌🏼!
|
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/github.com-oapi-codegen-runtime-1.x
branch
from
October 23, 2026 12:59
93a6977 to
45579af
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.3.1→v1.8.0Release Notes
oapi-codegen/runtime (github.com/oapi-codegen/runtime)
v1.8.0: : Bind the request body value the validator sawCompare Source
This release adds a request body binder that reuses the value a kin-openapi validation middleware already decoded, so strict servers no longer decode the body a second time with different matching rules. It also rounds out
types.Date's text encoding and fixes adeepObjectserialization quirk. Existing binding and serialization behaviour is unchanged unless generated code calls the new function. The root module's dependencies are unchanged; the separatestrictmiddleware/echo-v5module now requires Echo v5.4.2.Notable Changes
BindJSONBody: bind exactly what the validator validatedStrict servers generated by
oapi-codegendecode the JSON request body withencoding/jsonafter a validation middleware has already decoded and validated it. The two decoders do not agree on member names:encoding/jsonmatches struct fields case-insensitively, so a body like{"role":"user","ROLE":"admin"}validates asrole: userand then binds asRole: "admin". Anything the validator checked can be bypassed by a differently-cased duplicate.BindJSONBody(r *http.Request, v any) errorcloses that gap. When the request has passed through a validator built on kin-openapi v0.151.0 or later withopenapi3filter.Options.KeepValidatedValueset, the body carries the value the validator decoded, andBindJSONBodybinds that value into the destination withBindJSONValue(value, v any) errorinstead of reading the body again. Binding followsencoding/json's rules (struct tags, embedded structs,json.Unmarshalerandencoding.TextUnmarshaler, base64 for[]byte,float64forany,json.Numberpreserved) with one deliberate difference: member names are matched to struct fields exactly.Without a validated value, or when the value cannot be bound into the destination type,
BindJSONBodyfalls back tojson.NewDecoder(r.Body).Decode(v), so error responses are unchanged for everyone who is not running a validator. The oapi-codegen validation middlewares enableKeepValidatedValueby default as of nethttp-middleware v1.3.1, echo-middleware v1.2.1, echo-v5-middleware v0.2.1, gin-middleware v1.2.1 and iris-middleware v1.2.1. The net/http strict server template that callsBindJSONBodyis landing inoapi-codegenseparately (oapi-codegen/oapi-codegen#2605); the runtime side ships first so generated code can rely on it.types.Dateimplementsencoding.TextMarshalerDatehad anUnmarshalTextthat parses2006-01-02but noMarshalText, so it inheritedtime.Time's RFC 3339 one. Any codec that pairsTextMarshalerwithTextUnmarshaler(encoding/xml, DynamoDB mappers, and others) therefore wrote aDateit could not read back.MarshalTextnow formats withDateFormat, matchingMarshalJSON,StringandUnmarshalText. Thanks to @jusabe-kreditz.deepObjectno longer emitsparam[]=nullfor nil maps and slicesMarshalling a
deepObjectparameter whose field held a typed nil map or nil slice produced aparam[]=nullpair, because the intermediatejson.Marshalturned the nil intonull. Such fields are now omitted, as an empty map or slice already was. Nil pointers are still serialized asnull, as before. Thanks to @SKalt (#160).🚀 New features and improvements
🐛 Bug fixes
📦 Dependency updates
6 changes
Sponsors
We would like to thank our sponsors for their support during this release.
New contributors
v1.7.0: : Extensions for OpenAPI 3.1 parameter bindingCompare Source
This release teaches the parameter binders about OpenAPI 3.1 multi-type unions, and fixes a long-standing panic on the request binding path. As with v1.6.0, new behavior is controlled by explicit settings rather than assumptions: binding stays exactly as it was unless the new options are used.
Notable Changes
Binding OpenAPI 3.1 multi-type union parameters
OpenAPI 3.1 allows a parameter's
typeto be a list, such astype: [string, integer]. Go has no type meaning "one of these", so generated code maps such parameters toany— which the binders previously rejected outright withcan not bind to destination of type: interface, making these parameters unusable.The binder options structs (
BindStyledParameterOptions,BindQueryParameterOptions,BindStringToObjectOptions) gain aTypes []stringfield carrying the union's member list. It is only consulted when the destination is anany; binding into every concrete Go type is completely unchanged. The value binds to the first member that parses, tryingboolean,integer,number, thenstring— most restrictive first, since a string always parses. Member detection follows the JSON number grammar (RFC 8259), so values like007or+1bind as strings rather than being silently reinterpreted as numbers.The bound value's dynamic type is always one of
bool,int64,float64,string, or (withformat: byte)[]byte, so a handler's type switch is stable regardless of what the spec'sformatsays. Applications that wantformat: int32/format: floatto narrow the produced types toint32/float32can opt in via a new package-level setting, following the same pattern asDefaultQueryEncoderfrom v1.6.0:Generator support for emitting
Typesis landing inoapi-codegenseparately; the runtime side ships first so generated code can rely on it. Arrays of unions anddeepObject-style parameters are not covered yet — see theTypesfield documentation for the exact scope.Fix for a panic when binding numeric values into slice destinations
Since v1.2.0, binding a string that happens to parse as an integer into a non-
[]byteslice destination panicked withreflect: call of reflect.Value.OverflowInt on slice Value, instead of returning an error. This was reachable from generated code on the request path: anullable.Nullable[[]string]query parameter using the default form/explode serialization would panic on?p=123while returning a normal binding error on?p=abc. These cases now return a cleancan not bind to destination of type: sliceerror.🚀 New features and improvements
🐛 Bug fixes
✍ Other changes
📦 Dependency updates
6 changes
Sponsors
We would like to thank our sponsors for their support during this release.
v1.6.0: Allow customization of parameter encodingCompare Source
This is a small release which adds a global encoding setting on the runtime, to allow users to customize how to handle spaces in query arguments. This is a new minor release, since we're adding new API, even though this is a very minor feature. I imagine that in the future, we will add more settings, rather than making behavior assumptions.
🚀 New features and improvements
📦 Dependency updates
Sponsors
We would like to thank our sponsors for their support during this release.
Sponsors
We would like to thank our sponsors for their support during this release.
v1.5.0: : RFC3339 durations, and bug fixesCompare Source
This is mainly a bugfix release, but we're bumping the minor version since we also introduce a new type,
Durationinto ourtypes/package, which allows for parsing and emitting RFC3339 durations. Rather than trying to parse a duration string into atime.Duration, which requires assumptions that may not be right for everyone, we decided not to make those decisions and just store all possible fields as provided. Users can convert this to Go Duration as they see fit.🚀 New features and improvements
🐛 Bug fixes
📝 Documentation updates
📦 Dependency updates
6 changes
Sponsors
We would like to thank our sponsors for their support during this release.
v1.4.2: Bug fix for required parametersCompare Source
This is a bug fix to address a regression introduced in oapi-codegen v2.7.0
🐛 Bug fixes
Sponsors
We would like to thank our sponsors for their support during this release.
v1.4.1: Bug fixesCompare Source
This is a bug fix release.
Changes in
v1.4.0, coupled with changes inv2.7.0of oapi-codegen exposed some new problems.deepObjectstyle marshaling behavior now supports encoding unicode. UTF-8 can't be directly included in parameters, so we need to%escape it.Form binding now detects maps, which makes binding to a Nullable possible. We can't use generics around
Nullable[T], so we handle maps generically, assuming they're a Nullable with its behavior assumptions.🐛 Bug fixes
📦 Dependency updates
Sponsors
We would like to thank our sponsors for their support during this release.
v1.4.0: Parameter handling improvements and fixesCompare Source
This release fixes some missing edge cases in parameter binding and styling. We now handle all the permutations of style and explode, for the first time. Lots of tests have been added to catch regressions.
🚀 New features and improvements
🐛 Bug fixes
📦 Dependency updates
Sponsors
We would like to thank our sponsors for their support during this release.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.