[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/oapi-codegen/echo-middleware	v1.0.2 → v1.2.1

---

Release Notes

oapi-codegen/echo-middleware (github.com/oapi-codegen/echo-middleware)

v1.2.1: : keep the validated request body value by default

Compare Source

This release enables openapi3filter.Options.KeepValidatedValue by default. It was meant to ship in v1.2.0 together with the kin-openapi v0.152.0 update, but was merged after that release was published.

With it on, the validator leaves the request body readable exactly as before and additionally keeps the decoded, validated JSON value on the body, reachable through its ValidatedValue() any method. Upcoming oapi-codegen strict server templates use this to bind the value that was actually validated instead of decoding the body a second time, which closes the gap described in oapi-codegen/oapi-codegen#2605 (encoding/json matches member names case-insensitively, so a second decode can pick up a member the validator never saw).

Handlers that read the body see no difference. The only costs are that the decoded value stays in memory for the lifetime of the request, and that the body no longer implements optional interfaces such as io.WriterTo.

To opt out, set DiscardValidatedValue: true in this middleware's Options. This setting overrides KeepValidatedValue in the embedded openapi3filter.Options. Middleware that replaces the request body must run before the validator, otherwise the validated value is lost.

🚀 New features and improvements

• Keep the validated request body value by default (#​68) @​mromaszewicz

Sponsors

We would like to thank our sponsors for their support during this release.

New contributors

• No new contributors

v1.2.0: : kin-openapi v0.152.0 dependency update

Compare Source

This is a dependency update release. It moves the required kin-openapi version to v0.152.0, which also raises the minimum for every project using this middleware. It also fixes request bodies being drained before the handler when Options.Prefix is set (#​49), thanks to @​karlpip.

Behaviour changes that come with kin-openapi v0.150.0 to v0.152.0 and that users may notice:

• JSON request bodies with duplicate member names are rejected when the binary is built with Go 1.27 and its default encoding/json (this is decided by the toolchain, not by this middleware).
• In OpenAPI 3.0 documents, fields placed next to a $ref are ignored, as the specification requires.
• Integer parameters are parsed as base 10 only.
• spaceDelimited and pipeDelimited query parameters default to explode: false.
• openapi3filter.Options.KeepValidatedValue is available for passing through Options.Options; it leaves the validated request body value on the request for handlers that can use it.

This release also picks up the kin-openapi security fix from v0.149.0 (GHSA-r277-6w6q-xmqw) for anyone still on an older version.

🐛 Bug fixes

• fix (#​49): restore body on clone (#​61) @​karlpip, @​claude, @​mromaszewicz

📦 Dependency updates

7 changes

• fix(deps): update module github.com/getkin/kin-openapi to v0.152.0 (#​67) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.10.0 (#​63) @​renovate[bot]
• chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#​64) @​renovate[bot]
• chore(deps): update oapi-codegen/actions action to v0.9.2 (#​65) @​renovate[bot]
• fix(deps): update module github.com/labstack/echo/v4 to v4.16.0 (#​66) @​renovate[bot]
• fix(deps): update module github.com/getkin/kin-openapi to v0.149.0 [security] (#​62) @​renovate[bot]
• fix(deps): update module github.com/getkin/kin-openapi to v0.143.0 (#​59) @​renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

New contributors

• @​karlpip made their first contribution in #​61

v1.1.0: OpenAPI 3.1, Go 1.25

Compare Source

This release bumps the required Go version to 1.25, and pulls in a version of kin-openapi which can validate OpenAPI 3.1 specifications.

🎉 Notable changes

• OpenAPI 3.1 support in kin-openapi (#​56) @​mromaszewicz
• Modernize + make more consistent with net/http (#​38) @​jamietanna

🐛 Bug fixes

• fix: unescape URL-encoded path params before OpenAPI validation (#​43) @​mromaszewicz, @​claude, @​florentchauveau
• feat: add Prefix option for sub-path mounted APIs (#​42) @​mromaszewicz, @​claude, @​GreyXor

📝 Documentation updates

• docs(sponsors): add FUNDING.yml (#​21) @​jamietanna

👻 Maintenance

• Add a tidy-ci rule to make CI happy (#​58) @​mromaszewicz
• chore: Update Go to 1.24 and update CI (#​47) @​mromaszewicz, @​claude

📦 Dependency updates

• chore(deps): update oapi-codegen/actions action to v0.8.0 (#​54) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7 (#​55) @​renovate[bot]
• OpenAPI 3.1 support in kin-openapi (#​56) @​mromaszewicz
• chore(deps): update module github.com/golangci/golangci-lint to v2 (#​24) @​renovate[bot]
• chore(deps): pin dependencies (#​25) @​renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 17 additional dependencies were updated

Details:

Package	Change
github.com/getkin/kin-openapi	v0.133.0 -> v0.152.0
github.com/labstack/echo/v4	v4.15.1 -> v4.16.0
github.com/go-openapi/jsonpointer	v0.21.2 -> v1.0.0
github.com/labstack/gommon	v0.4.2 -> v0.5.0
github.com/mattn/go-colorable	v0.1.14 -> v0.1.15
github.com/mattn/go-isatty	v0.0.20 -> v0.0.23
github.com/oasdiff/yaml	v0.0.0-20250309154309-f31be36b4037 -> v0.1.1
github.com/oasdiff/yaml3	v0.0.0-20250309153720-d2182401db90 -> v0.0.14
golang.org/x/crypto	v0.49.0 -> v0.54.0
golang.org/x/mod	v0.33.0 -> v0.37.0
golang.org/x/net	v0.52.0 -> v0.57.0
golang.org/x/sync	v0.20.0 -> v0.22.0
golang.org/x/sys	v0.42.0 -> v0.47.0
golang.org/x/term	v0.41.0 -> v0.45.0
golang.org/x/text	v0.35.0 -> v0.40.0
golang.org/x/time	v0.14.0 -> v0.15.0
golang.org/x/tools	v0.42.0 -> v0.47.0