[dependabot]

Bumps the oapi-codegen group with 2 updates in the / directory: github.com/oapi-codegen/nethttp-middleware and github.com/oapi-codegen/runtime.

Updates github.com/oapi-codegen/nethttp-middleware from 1.2.0 to 1.3.1

Release notes

Sourced from github.com/oapi-codegen/nethttp-middleware's releases.

v1.3.1: keep the validated request body value by default

This release enables openapi3filter.Options.KeepValidatedValue by default. It was meant to ship in v1.3.0 together with the kin-openapi v0.152.0 update, but was merged after that release was published.

With it on, the validator leaves the request body readable exactly as before and additionally keeps the decoded, validated JSON value on the body, reachable through its ValidatedValue() any method. Upcoming oapi-codegen strict server templates use this to bind the value that was actually validated instead of decoding the body a second time, which closes the gap described in oapi-codegen/oapi-codegen#2605 (encoding/json matches member names case-insensitively, so a second decode can pick up a member the validator never saw).

Handlers that read the body see no difference. The only costs are that the decoded value stays in memory for the lifetime of the request, and that the body no longer implements optional interfaces such as io.WriterTo.

To opt out, set DiscardValidatedValue: true in this middleware's Options. This setting overrides KeepValidatedValue in the embedded openapi3filter.Options. Middleware that replaces the request body must run before the validator, otherwise the validated value is lost.

🚀 New features and improvements

• Keep the validated request body value by default (#91) @​mromaszewicz

📦 Dependency updates

• Bump kin-openapi to v0.152.0 in the internal test modules (#92) @​mromaszewicz

Sponsors

We would like to thank our sponsors for their support during this release.

New contributors

• No new contributors

v1.3.0: kin-openapi v0.152.0 dependency update

This is a dependency update release. It moves the required kin-openapi version to v0.152.0, which also raises the minimum for every project using this middleware.

Behaviour changes that come with kin-openapi v0.150.0 to v0.152.0 and that users may notice:

• JSON request bodies with duplicate member names are rejected when the binary is built with Go 1.27 and its default encoding/json (this is decided by the toolchain, not by this middleware).
• In OpenAPI 3.0 documents, fields placed next to a $ref are ignored, as the specification requires.
• Integer parameters are parsed as base 10 only.
• spaceDelimited and pipeDelimited query parameters default to explode: false.

... (truncated)

Commits

• f54b15f Bump kin-openapi to v0.152.0 in the internal test modules (#92)
• 1e8d2f2 Keep the validated request body value by default (#91)
• cbcfbcf fix(deps): update module github.com/getkin/kin-openapi to v0.152.0 (#90)
• bde3b6d chore(deps): update oapi-codegen/actions action to v0.9.2 (#88)
• 0ccfcf4 chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#87)
• c49bbc1 chore(deps): update release-drafter/release-drafter action to v7.10.0 (#86)
• a5360e0 fix(deps): update module github.com/getkin/kin-openapi to v0.149.0 [security]...
• 2bc9e4d fix(deps): update module github.com/getkin/kin-openapi to v0.143.0 (#81)
• See full diff in compare view

Updates github.com/oapi-codegen/runtime from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

v1.8.0: Bind the request body value the validator saw

This release adds a request body binder that reuses the value a kin-openapi validation middleware already decoded, so strict servers no longer decode the body a second time with different matching rules. It also rounds out types.Date's text encoding and fixes a deepObject serialization quirk. Existing binding and serialization behaviour is unchanged unless generated code calls the new function. The root module's dependencies are unchanged; the separate strictmiddleware/echo-v5 module now requires Echo v5.4.2.

Notable Changes

BindJSONBody: bind exactly what the validator validated

Strict servers generated by oapi-codegen decode the JSON request body with encoding/json after a validation middleware has already decoded and validated it. The two decoders do not agree on member names: encoding/json matches struct fields case-insensitively, so a body like {"role":"user","ROLE":"admin"} validates as role: user and then binds as Role: "admin". Anything the validator checked can be bypassed by a differently-cased duplicate.

BindJSONBody(r *http.Request, v any) error closes that gap. When the request has passed through a validator built on kin-openapi v0.151.0 or later with openapi3filter.Options.KeepValidatedValue set, the body carries the value the validator decoded, and BindJSONBody binds that value into the destination with BindJSONValue(value, v any) error instead of reading the body again. Binding follows encoding/json's rules (struct tags, embedded structs, json.Unmarshaler and encoding.TextUnmarshaler, base64 for []byte, float64 for any, json.Number preserved) with one deliberate difference: member names are matched to struct fields exactly.

Without a validated value, or when the value cannot be bound into the destination type, BindJSONBody falls back to json.NewDecoder(r.Body).Decode(v), so error responses are unchanged for everyone who is not running a validator. The oapi-codegen validation middlewares enable KeepValidatedValue by default as of nethttp-middleware v1.3.1, echo-middleware v1.2.1, echo-v5-middleware v0.2.1, gin-middleware v1.2.1 and iris-middleware v1.2.1. The net/http strict server template that calls BindJSONBody is landing in oapi-codegenoapi-codegen/oapi-codegen#2605

types.Date implements encoding.TextMarshaler

Date had an UnmarshalText that parses 2006-01-02 but no MarshalText, so it inherited time.Time's RFC 3339 one. Any codec that pairs TextMarshaler with TextUnmarshaler (encoding/xml, DynamoDB mappers, and others) therefore wrote a Date it could not read back. MarshalText now formats with DateFormat, matching MarshalJSON, String and UnmarshalText. Thanks to @​jusabe-kreditz.

deepObject no longer emits param[]=null for nil maps and slices

Marshalling a deepObject parameter whose field held a typed nil map or nil slice produced a param[]=null pair, because the intermediate json.Marshal turned the nil into null. Such fields are now omitted, as an empty map or slice already was. Nil pointers are still serialized as null, as before. Thanks to @​SKalt (#160).

🚀 New features and improvements

• Add BindJSONBody to bind the request body value kin-openapi validated (#165) @​mromaszewicz
• Add MarshalText to types.Date (#162) @​jusabe-kreditz, @​mromaszewicz

🐛 Bug fixes

• fix: omit nil maps and slices from deepObject marshalling (#161) @​SKalt, @​mromaszewicz

📦 Dependency updates

• fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164) @​renovate[bot]
• fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163) @​renovate[bot]
• chore(deps): update github/codeql-action action to v4.39.1 (#159) @​renovate[bot]
• chore(deps): update oapi-codegen/actions action to v0.9.2 (#158) @​renovate[bot]
• chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157) @​renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

... (truncated)

Commits

• c0b2ca2 fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166)
• 170896a Add BindJSONBody to bind the request body value kin-openapi validated (#165)
• c702e06 fix: omit nil maps and slices from deepObject marshalling (#161)
• ea5fc39 Add MarshalText to types.Date (#162)
• 64f16fb chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164)
• 9808d04 fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163)
• df8dfa8 chore(deps): update github/codeql-action action to v4.39.1 (#159)
• ae0fff0 chore(deps): update oapi-codegen/actions action to v0.9.2 (#158)
• 2fd3480 chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157)
• See full diff in compare view

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: openmeterio/openmeter
• Branch: main
• File: .coderabbit.yaml
• Commit: 24eece4
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: c36341b0-4a16-42fb-9610-5b9b89e594a1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn