chore(deps): update module github.com/oapi-codegen/oapi-codegen/v2 to v2.7.0 #71
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "renovate/github.com-oapi-codegen-oapi-codegen-v2-2.x"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
This PR contains the following updates:
v2.5.1→v2.7.0Release Notes
oapi-codegen/oapi-codegen (github.com/oapi-codegen/oapi-codegen/v2)
v2.7.0: : Squashing bugs, many bugs (and adding some features)Compare Source
Many improvements and even more bug fixes
This
v2.7.0release ofoapi-codegencontains quite a bit of internal refactoring, focused on our most historically fragile code paths, which relate to the aggregate types (allOf/anyOf/oneOf),$refto external specs, enums, and the spec traversal logic missing quite a few leaf nodes where models should have been generated, but were skipped.The biggest changes are explicitly described in the sections below, and the full list of commits is at the bottom.
Thank you to all contributors, we've been going through all past PR's and updating them and merging where we can, and thanks to all our users for reporting issues that you hit.
I've (@mromaszewicz) used a lot of LLM help here to scrub through old issues and do some deep internal refactoring to address common problem areas. I intend to continue doing this, since the conditional generation logic is getting quite complicated. When I originally released
oapi-codegen, the use case was much simpler, all the models were under#/components/schemas, and all the references to them were in the requests, responses, etc. I never imagine how many things would be external references or unions, and how many complex OpenAPI specifications people would be generating code for. The initial design was never flexible enough to handle that, so ongoing bug fixes are getting increasingly complex due to edge cases. This version has a lot of internal changes you won't see as a user, but the way we handle type generation internally is unifying lots of copy/paste re-implementations into reusable code for consistency. Most of these changes can be done transparently, but some can't, so, onto the changes:Code generation changes which might require some changes on your end
This release contains three changes, all very narrow in scope, which will require some manual adjustment of your own code. We've decided that these are small enough and uncommon enough not to require opt-in, which causes internal complexity. It's always a judgment call with these. If we got it wrong, we're happy to revisit it in a maintenance release.
Strict-server external response refs require strict-server generation in both packages (#2357)
If your strict-server spec uses an external
$refto acomponents/responses/...defined in another spec, that otherspec must also be generated with
strict-server: true. Add it to the source spec's config and regenerate:This restores the v2.0.0 behavior that lets you cast response models across package boundaries — the standard pattern
for sharing error models (e.g. a common
400) across services. PR #1387 had silently changed the embedded type fromN400JSONResponseto the bareexternalRef0.N400, so the local and external response structs no longer hadmatching types and casts stopped compiling.
Many more anonymous inner schemas are now hoisted into top level schemas
Inline
oneOf,anyOf, andadditionalPropertiesschemas embedded directly under an operation's request or responsebody now flow through the same boilerplate-emission pipeline as
components/schemas, so they get theAs*/From*/Merge*accessor methods they were previously missing. As part of that change, two older naming patternsare replaced with one pattern, shared with all components:
In practice, we think this shouldn't break anyone, because this change addresses a bug which produced pointless types
with no benefit, and you never interact with these directly, but rather you'd call an accessor on a field of a model.
Strict middleware typedefs are now inlined (#2271)
StrictHandlerFuncandStrictMiddlewareFuncin generated strict-server code are now inline type definitions insteadof aliases to
github.com/oapi-codegen/runtime/strictmiddleware/<framework>. Generated servers no longer import that package.Before (Echo example):
After:
If your code referenced the per-framework names directly —
strictecho.StrictEchoHandlerFunc,strictgin.StrictGinHandlerFunc,strictnethttp.StrictHTTPHandlerFunc,strictiris.StrictIrisHandlerFunc,strictecho5.StrictEcho5HandlerFunc— switch to the localStrictHandlerFunc/StrictMiddlewareFuncexposed by the generated server package, or importruntime/strictmiddleware/<framework>yourself if you really want those names. The underlying signatures are unchanged, so any value satisfying the old type still satisfies the new one.🎉 Notable changes
Go 1.24 required (#2264)
oapi-codegenitself now requires Go 1.24.4+ to build and run. The toolchain in your project'sgo.mod(the one used to invoke the codegen) must be ≥ 1.24.4. The code generated will still likely work on older versions. We had to update to Go 1.24 in order to update some dependencies to address vulnerabilities. Go 1.24 is no longer supported, so our next release will update to Go 1.25,and the plan is to stay on supported Go versions. I'm not sure if 1.25 will come in v2.8.0 or v2.7.1 yet, but it's imminent. We
have a number of submodules in this repo which exist only to test Go 1.25 routers in a 1.24 module, and it allows us to
simplify.
Unfortunately, some of our transitive dependencies result in a broken build, by default, so you might have to pin these
packages to specific versions:
Multi-pass type name resolution (#2213)
Set
output-options.resolve-type-name-collisions: trueto make the codegen detect identifier collisions across schemas, parameters, request bodies, response components, and operation-derived types — and resolve them deterministically by suffixing the loser. Specs that previously failed to generate because two definitions wanted the same Go name now succeed.Trivial example. With this spec:
output-options.resolve-type-name-collisions: trueproduces:Collision resolution is opt-in. Generated identifier names depend on the current set of collisions in the spec;
adding a new schema or parameter later that collides with an existing one will rename the existing one to break the new collision.
That can silently break user code that imports the previously-stable name as the spec drifts. However, despite the drift,
more specs can now correctly generate boilerplate.
Parameter binding matrix (#2307)
The OpenAPI parameter
style×explode×typematrix is now fully supported and round-trips consistently acrossevery server backend. Path/query/header/cookie parameters across primitive, array, and object types — including
style: form / spaceDelimited / pipeDelimited / deepObject×explode: true/false, andstyle: simplefor headers —generate the same binding logic on every server, and the client-side encoding is symmetric. The internal parameter test suite (
internal/test/parameters/) now exercises every combination through a server round-trip per backend.If you previously hit an
unsupported styleerror, or saw a parameter serialization work under one backend but not another,regenerate and the issue should be gone.
You will need to use version
v1.4.0or higher ofgithub.com/oapi-codegen/runtime.Optional / nullable response headers (#2301)
For strict-server responses, optional and nullable headers now generate as pointer fields (or
nullable.Nullable[T]when the
nullable-typesoutput option is set). The generated server only callsw.Header().Set(...)when the fieldis non-nil, so callers can omit optional headers cleanly.
Spec:
Before:
After:
To opt out of this change, set
compatibility.headers-implicitly-required: trueto restore the previous always-required behavior. This change breaks enough code that we flagified it.🚀 New features
Echo v5 server support (#2188)
Echo v5 (the upcoming major version) is now a supported server framework. Generate with
generate.echo5-server: true. Echo v4 is unchanged and remains the target ofgenerate.echo-server.Per-handler middleware in Fiber (#2302)
Fiber generated servers now accept a
HandlerMiddlewares []HandlerMiddlewareFuncslice inFiberServerOptions, applied around every operation handler. The middleware signature isfunc(c *fiber.Ctx, next fiber.Handler) error, matching Fiber's native middleware pattern. Useful for cross-cutting concerns (auth, logging, metrics) that should run after path-level routing but inside the generated-handler boundary.Per-operation middleware in Echo (#2353)
Echo's
RegisterHandlersWithOptionsnow accepts anOperationMiddlewares map[string][]echo.MiddlewareFunckeyed byoperationId, attaching middleware to specific operations at registration time:Operations with no entry in the map (or a
nilmap) are registered with no extra middleware. Available for both Echo v4 and Echo v5 generated servers.Strict-gin error handlers (#1600)
The Gin strict server now exposes
RequestErrorHandlerFuncandResponseErrorHandlerFunconStrictServerOptions, matching the pattern already available for the Echo strict server. Bind errors and response-write errors flow through your custom handler instead of using gin's default abort behaviour. Defaults are preserved if you don't set them.☢️ Breaking changes
🎉 Notable changes
🚀 New features and improvements
🐛 Bug fixes
initialism-overridesoption (#2287) @gaiaz-iusipovtext/plainrequests (#1975) @jamietanna📝 Documentation updates
👻 Maintenance
📦 Dependency updates
9 changes
github.com/speakeasy-api/openapi/overlay(#2231) @netixxSponsors
We would like to thank our sponsors for their support during this release.
v2.6.0: : 7th anniversary release 🎂Compare Source
For those that aren't aware, 7 years ago to the day,
oapi-codegenwas born!(Well, technically it's tonight at midnight UTC, but who's splitting hairs?)
There's nothing too special planned for today, but we thought it'd be the perfect time to cut
a slice of cakea release!🎉 Notable changes
New generated code requires
oapi-codegen/runtimev1.2.0+As part of #2256,
github.com/oapi-codegen/runtimev1.2.0 is needed alongsidegithub.com/oapi-codegen/oapi-codegen, for new generated code.This is providing a more future-proofed means to bind parameters.
See the release notes for the runtime package, and #2256 for more information.
oapi-codegenwas part of the GitHub Secure Open Source Fundoapi-codegenwas one of the projects taking part in the third GitHub Secure Open Source Fund session.We've written up more about what we've learned, and have some more things to share with you over the coming months about lessons we've learned and improvements we've taken that we can share.
We were pretty chuffed to be selected, and it's already helped improve our security posture as a project, which is also very important for the wider ecosystem!
godirective bump in next releaseLong-time users will be aware that we work very hard to try and keep our requirement for Go source compatibility, through the
godirective, especially as we recommend folks useoapi-codegenas a source-tracked dependency.For more details about this, see our Support Model docs.
In the next minor release, we'll be setting our minimum
godirective to Go 1.24 (End-of-Life on 2026-02-11), as it's required for a number of dependencies of ours to be updated any higher, and a change to the module import path for Speakeasy's OpenAPI Overlay library requires us fix this centrally for our users to be able to continue updating their libraries.Behind the scenes cleanup
There's also been some work behind-the-scenes to try and clean up outstanding issues (of which we know there are many!) that have been fixed, as well as Marcin's work on trying to do some more significant rework of the internals with help from Claude.
There's still, as ever, work to go with this - as we've mentioned before, sponsoring our work would be greatly appreciated, so we can continue to put in the work, considering this is a widely used and depended on project.
🚀 New features and improvements
resolve-type-name-collisionsto avoid name collisions (#200) @mgurevin🐛 Bug fixes
nullable.Nullablein arrays (#2242) @jamietannadescriptionis empty (#2226) @jamietanna$reftext responses (#2225) @mromaszewicz📝 Documentation updates
👻 Maintenance
go fix(#2229) @gaiaz-iusipovmake tidyafter Go module updates (#2159) @jamietannamake tidyafter dependency updates togo.mod(#2150) @jamietanna📦 Dependency updates
8 changes
Sponsors
We would like to thank our sponsors for their support during this release.
Configuration
📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Renovate Bot.
7f1aaab244toca2bb8c610ca2bb8c610to06aacdbe2b06aacdbe2btodcf357e4e2dcf357e4e2to9895826dd19895826dd1to16f23deb9f16f23deb9fto196cec5d3c196cec5d3cto2b27f573112b27f57311to5647df30725647df3072tofcdb5ecd9c5647df3072to67415790006741579000to8a364888458a36488845to74dbb77cf974dbb77cf9toa2b214f12fa2b214f12ftof6b9c974e1⚠️ Artifact update problem
Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.
♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below:
File name: go.sum
f6b9c974e17c6ff124e77c6ff124e79f5e52a96e9f5e52a96ed7b386d33cchore(deps): update module github.com/oapi-codegen/oapi-codegen/v2 to v2.6.0to chore(deps): update module github.com/oapi-codegen/oapi-codegen/v2 to v2.7.0