[dependabot]

Bumps the dependencies group with 2 updates: github.com/oapi-codegen/runtime and github.com/oapi-codegen/oapi-codegen/v2.

Updates github.com/oapi-codegen/runtime from 1.7.0 to 1.8.0

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

v1.8.0: Bind the request body value the validator saw

This release adds a request body binder that reuses the value a kin-openapi validation middleware already decoded, so strict servers no longer decode the body a second time with different matching rules. It also rounds out types.Date's text encoding and fixes a deepObject serialization quirk. Existing binding and serialization behaviour is unchanged unless generated code calls the new function. The root module's dependencies are unchanged; the separate strictmiddleware/echo-v5 module now requires Echo v5.4.2.

Notable Changes

BindJSONBody: bind exactly what the validator validated

Strict servers generated by oapi-codegen decode the JSON request body with encoding/json after a validation middleware has already decoded and validated it. The two decoders do not agree on member names: encoding/json matches struct fields case-insensitively, so a body like {"role":"user","ROLE":"admin"} validates as role: user and then binds as Role: "admin". Anything the validator checked can be bypassed by a differently-cased duplicate.

BindJSONBody(r *http.Request, v any) error closes that gap. When the request has passed through a validator built on kin-openapi v0.151.0 or later with openapi3filter.Options.KeepValidatedValue set, the body carries the value the validator decoded, and BindJSONBody binds that value into the destination with BindJSONValue(value, v any) error instead of reading the body again. Binding follows encoding/json's rules (struct tags, embedded structs, json.Unmarshaler and encoding.TextUnmarshaler, base64 for []byte, float64 for any, json.Number preserved) with one deliberate difference: member names are matched to struct fields exactly.

Without a validated value, or when the value cannot be bound into the destination type, BindJSONBody falls back to json.NewDecoder(r.Body).Decode(v), so error responses are unchanged for everyone who is not running a validator. The oapi-codegen validation middlewares enable KeepValidatedValue by default as of nethttp-middleware v1.3.1, echo-middleware v1.2.1, echo-v5-middleware v0.2.1, gin-middleware v1.2.1 and iris-middleware v1.2.1. The net/http strict server template that calls BindJSONBody is landing in oapi-codegenoapi-codegen/oapi-codegen#2605

types.Date implements encoding.TextMarshaler

Date had an UnmarshalText that parses 2006-01-02 but no MarshalText, so it inherited time.Time's RFC 3339 one. Any codec that pairs TextMarshaler with TextUnmarshaler (encoding/xml, DynamoDB mappers, and others) therefore wrote a Date it could not read back. MarshalText now formats with DateFormat, matching MarshalJSON, String and UnmarshalText. Thanks to @​jusabe-kreditz.

deepObject no longer emits param[]=null for nil maps and slices

Marshalling a deepObject parameter whose field held a typed nil map or nil slice produced a param[]=null pair, because the intermediate json.Marshal turned the nil into null. Such fields are now omitted, as an empty map or slice already was. Nil pointers are still serialized as null, as before. Thanks to @​SKalt (#160).

🚀 New features and improvements

• Add BindJSONBody to bind the request body value kin-openapi validated (#165) @​mromaszewicz
• Add MarshalText to types.Date (#162) @​jusabe-kreditz, @​mromaszewicz

🐛 Bug fixes

• fix: omit nil maps and slices from deepObject marshalling (#161) @​SKalt, @​mromaszewicz

📦 Dependency updates

• fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166) @​renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164) @​renovate[bot]
• fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163) @​renovate[bot]
• chore(deps): update github/codeql-action action to v4.39.1 (#159) @​renovate[bot]
• chore(deps): update oapi-codegen/actions action to v0.9.2 (#158) @​renovate[bot]
• chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157) @​renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

... (truncated)

Commits

• c0b2ca2 fix(deps): update module github.com/labstack/echo/v5 to v5.4.2 (#166)
• 170896a Add BindJSONBody to bind the request body value kin-openapi validated (#165)
• c702e06 fix: omit nil maps and slices from deepObject marshalling (#161)
• ea5fc39 Add MarshalText to types.Date (#162)
• 64f16fb chore(deps): update release-drafter/release-drafter action to v7.10.0 (#164)
• 9808d04 fix(deps): update module github.com/labstack/echo/v5 to v5.4.1 (#163)
• df8dfa8 chore(deps): update github/codeql-action action to v4.39.1 (#159)
• ae0fff0 chore(deps): update oapi-codegen/actions action to v0.9.2 (#158)
• 2fd3480 chore(deps): update module github.com/golangci/golangci-lint to v2.15.0 (#157)
• See full diff in compare view

Updates github.com/oapi-codegen/oapi-codegen/v2 from 2.8.0 to 2.8.1

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

v2.8.1: Security fixes for codegen and at runtime

🎉 Notable changes

This is a security release on top of v2.8.0. It addresses five security findings reported against oapi-codegen:

• Strict servers could bind a different request body than the one the validation middleware checked (runtime behaviour of generated servers)
• Remote $refs in an untrusted specification could make the generator issue requests to arbitrary hosts (code generation)
• An operationId could inject Go code through the Echo per-operation middleware key (code generation)
• A request body content type could inject Go code through the webhook and callback initiators (code generation)
• Server x-go-name, server variables and non-string enum values could inject Go code (code generation)

Four of the five only matter when you generate code from a specification you do not control. The first one affects running servers, so please upgrade the generated code and the oapi-codegen/runtime and validation middleware modules together, as described below.

Allow-listing the remote documents a specification may reference

oapi-codegen resolves external $refs while it loads a specification. Until now it fetched any http(s) URL a document named, so a specification written by someone else could make the generator reach any host the build machine can see.

There is a new top-level configuration option, allow-remote-refs-from. Each entry is the URL of a referenced document exactly as it appears in the $ref, without the #... fragment, or "*" to allow any URL:

allow-remote-refs-from:
  - https://raw.githubusercontent.com/example/specs/main/common.yaml

For compatibility, this release defaults the option to "*" when it is omitted, so existing configurations keep working unchanged. The next minor release will default to refusing remote references. If your specification downloads other documents at generation time, tighten this now by listing them, or set the option to [] to refuse them all.

Better still, for reproducible builds, download the specifications you depend on, commit them next to your own, and reference them by relative path. References to local files are always followed, with no allow-listing involved, and your generated code no longer depends on a remote host being up and unchanged.

Strict servers bind the value the validation middleware validated

A validation middleware decodes the JSON request body to validate it, and the generated strict server then decoded it a second time. encoding/json matches member names case-insensitively, so a body such as

{"role": "user", "ROLE": "admin"}

validates as role: user but was bound as Role: "admin", bypassing the schema's constraints.

Strict servers for every supported framework now bind the value the middleware already validated, with exact member-name matching, and only fall back to decoding the body themselves when no validated value is present. For the fix to take effect you need all three of:

• code generated with this release;
• github.com/oapi-codegen/runtime v1.8.0 or later;
• a validation middleware that keeps the validated value, which the following versions do by default:
  • github.com/oapi-codegen/nethttp-middleware v1.3.1
  • github.com/oapi-codegen/echo-middleware v1.2.1
  • github.com/oapi-codegen/echo-v5-middleware v0.2.1
  • github.com/oapi-codegen/gin-middleware v1.2.1
  • github.com/oapi-codegen/iris-middleware v1.2.1
  • github.com/oapi-codegen/fiber-middleware v1.3.0
  • github.com/oapi-codegen/fiber-v3-middleware v0.3.0

... (truncated)

Commits

• 068f1bc Quote or validate every spec string that reaches generated Go source (2.8.x b...
• cedb781 Apply the "*" default to the loader used after an overlay (#2624)
• b4ddde8 Refuse remote $refs unless their host is in allow-remote-refs-from (2.8.x bac...
• 7e9bbce Bind the validated request body value in all strict servers (2.8.x backport) ...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[ph33nx]

Superseded by 83a5a07 (generator 2.8.1 taken; runtime 1.8 held, it raises the go floor to 1.25)