[red-hat-konflux]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/oapi-codegen/echo-middleware	v1.1.0 → v1.2.1

---

Release Notes

oapi-codegen/echo-middleware (github.com/oapi-codegen/echo-middleware)

v1.2.1: : keep the validated request body value by default

Compare Source

This release enables openapi3filter.Options.KeepValidatedValue by default. It was meant to ship in v1.2.0 together with the kin-openapi v0.152.0 update, but was merged after that release was published.

With it on, the validator leaves the request body readable exactly as before and additionally keeps the decoded, validated JSON value on the body, reachable through its ValidatedValue() any method. Upcoming oapi-codegen strict server templates use this to bind the value that was actually validated instead of decoding the body a second time, which closes the gap described in oapi-codegen/oapi-codegen#2605 (encoding/json matches member names case-insensitively, so a second decode can pick up a member the validator never saw).

Handlers that read the body see no difference. The only costs are that the decoded value stays in memory for the lifetime of the request, and that the body no longer implements optional interfaces such as io.WriterTo.

To opt out, set DiscardValidatedValue: true in this middleware's Options. This setting overrides KeepValidatedValue in the embedded openapi3filter.Options. Middleware that replaces the request body must run before the validator, otherwise the validated value is lost.

🚀 New features and improvements

• Keep the validated request body value by default (#​68) @​mromaszewicz

Sponsors

We would like to thank our sponsors for their support during this release.

New contributors

• No new contributors

v1.2.0: : kin-openapi v0.152.0 dependency update

Compare Source

This is a dependency update release. It moves the required kin-openapi version to v0.152.0, which also raises the minimum for every project using this middleware. It also fixes request bodies being drained before the handler when Options.Prefix is set (#​49), thanks to @​karlpip.

Behaviour changes that come with kin-openapi v0.150.0 to v0.152.0 and that users may notice:

• JSON request bodies with duplicate member names are rejected when the binary is built with Go 1.27 and its default encoding/json (this is decided by the toolchain, not by this middleware).
• In OpenAPI 3.0 documents, fields placed next to a $ref are ignored, as the specification requires.
• Integer parameters are parsed as base 10 only.
• spaceDelimited and pipeDelimited query parameters default to explode: false.
• openapi3filter.Options.KeepValidatedValue is available for passing through Options.Options; it leaves the validated request body value on the request for handlers that can use it.

This release also picks up the kin-openapi security fix from v0.149.0 (GHSA-r277-6w6q-xmqw) for anyone still on an older version.

🐛 Bug fixes

• fix (#​49): restore body on clone (#​61) @​karlpip, @​claude, @​mromaszewicz

📦 Dependency updates

7 changes

• fix(deps): update module github.com/getkin/kin-openapi to v0.152.0 (#​67) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.10.0 (#​63) @​renovate[bot]
• chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#​64) @​renovate[bot]
• chore(deps): update oapi-codegen/actions action to v0.9.2 (#​65) @​renovate[bot]
• fix(deps): update module github.com/labstack/echo/v4 to v4.16.0 (#​66) @​renovate[bot]
• fix(deps): update module github.com/getkin/kin-openapi to v0.149.0 [security] (#​62) @​renovate[bot]
• fix(deps): update module github.com/getkin/kin-openapi to v0.143.0 (#​59) @​renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

New contributors

• @​karlpip made their first contribution in #​61

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

Summary by Sourcery

Bug Fixes:

• Update the OpenAPI middleware and kin-openapi dependencies to versions that preserve validated request body values and restore request bodies correctly before handlers.

[red-hat-konflux]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
github.com/getkin/kin-openapi	v0.151.0 -> v0.152.0

[sourcery-ai]

Reviewer's Guide

Configuration

Upgrade echo-middleware to v1.2.1 and kin-openapi to v0.152.0, which enables retaining validated request-body values by default and includes the middleware's dependency update.

• go.mod L12, L20

Lock files and vendored code

Update the module checksums corresponding to the dependency upgrades.

• go.sum L125-126, L329-330

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook