[dependabot]

Bumps github.com/danielgtaylor/huma/v2 from 2.39.1 to 2.40.0.

Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.40.0

Overview

This release adds native support for stdlib UUIDs, cuts compile times for large APIs, and brings a big batch of correctness fixes across request limits, defaults, validation, and the Fiber adapter. It also raises the minimum Go version to 1.26 and includes a few intentional breaking changes, so please read the upgrade notes below.

Upgrade Notes

• Minimum Go version is now 1.26. Dependencies have been bumped too, picking up a few vulnerability fixes (#1149)
• Raw bodies now have default limits. Non-multipart RawBody operations (e.g. []byte uploads) now get the same default 1 MiB MaxBodyBytes and 5s BodyReadTimeout as regular bodies. Endpoints accepting larger or slower raw uploads should set these explicitly (-1 for unlimited) (#1095)
• Multipart now honors MaxBodyBytes. An explicitly set MaxBodyBytes is now enforced on multipart requests. Multipart remains exempt from the defaults, so existing uploads keep working unless you've set a limit (#1094)
• Overflowing default tags panic at startup. For example, int8 with default:"128" previously wrapped silently to -128; it now fails at registration (#1142)
• Out-of-range bound tags panic at startup. For example, int8 with maximum:"500". int8, int16, uint8 and uint16 fields also now advertise minimum/maximum from their Go type, so generated specs will change (#1143)

Security Fix

A malformed Accept header such as application/json;,b caused a panic during content negotiation. On net/http-based adapters this dropped the request; on Fiber, which doesn't recover handler panics unless the recover middleware is used, it crashed the server process. This affects v2.26.0 onwards, so upgrading is recommended. (#1128)

Native Stdlib UUIDs

On Go 1.27+, fields using the new standard library uuid.UUID type are automatically documented as type: string with format: uuid, with no struct tag needed. (#1051)

Faster Compile Times

huma.Register, sse.Register and the convenience helpers (huma.Get, huma.Post, ...) now keep their generic parts tiny, so Go no longer compiles a full copy of the registration logic for every input/output pair. In a 200-operation benchmark package, build time dropped from 3.38s to 0.64s. There are no API or runtime changes. (#1115, #1117)

New Features

• String SSE event IDs via sse.Message.IDString, for UUIDs, cursor tokens and other opaque IDs (#1086)
• Schema can be unmarshalled from JSON, including $ref, x- extensions and nullable types, and is ready for Validate once decoded (#1144)

Validation & Defaults Fixes

• {"type": "null"} is now validated. Previously it accepted any value, so an anyOf with a null branch skipped the constraints of its other branches (#1120)
• Numeric request parameters which overflow the destination Go type (e.g. 300 into an int8) now return 422 instead of silently wrapping (#1096)
• default tags on encoding.TextUnmarshaler types (e.g. a duration with default:"10s") are now applied via UnmarshalText instead of panicking (#1126)
• Defaults are now applied to absent exploded query arrays (#1116) and missing multipart form values (#1150), and array parameters accept JSON array defaults such as default:"[\"a\",\"b\"]" (#1125)
• Value-less query flags followed by other parameters (e.g. ?flag&foo=bar) are now detected correctly (#1097)
• PathBuffer.Pop restores the exact offset, fixing wrong error locations after discriminator errors (#1136)
• casing.Camel and casing.Join no longer panic or double-apply transforms when a transform removes a part (#1113)

Request Body Fixes

• A body of exactly MaxBodyBytes is now accepted instead of returning 413 (#1131)
• Multipart file handles are now closed after mime-type validation (#1085)

OpenAPI Fixes

• RawBody alongside Body no longer documents an extra application/octet-stream media type (#1134)
• The example tag on a Body field is now set as the media type example, since many tools ignore examples next to a $ref (#1101)

Adapter & Autopatch Fixes

• humafiber: multiple Set-Cookie headers are now sent as separate header lines instead of being comma-joined (#1137)
• humafiber (v2): autopatch now works, as its internal requests get a default Host (#1140)
• autopatch: PATCH responses are no longer compressed twice (#1130), and $refs are resolved when making the PUT schema optional (#1080)

Docs UI & Documentation

• Updated Scalar (1.76.0), Stoplight Elements (9.0.29) and SwaggerUI (5.34.0). Scalar no longer needs 'unsafe-eval' in its CSP, and its fonts now load (#1145)
• Clarified that router-agnostic middleware runs after route resolution (#1088)

... (truncated)

Commits

• 4035252 fix: apply the default tag to missing multipart form values (#1150)
• c8a8e79 docs: clarify router-agnostic middleware runs after route resolution (#1088)
• 2955ed8 fix: respect MaxBodyBytes limit for raw bodies (#1095)
• e83a6e9 fix(multipart): respect MaxBodyBytes limit (#1094)
• 0e93ae2 fix(humafiber): keep multiple Set-Cookie headers separate (#1137)
• e0e7d92 fix(humafiber): default the Host so autopatch works on Fiber v2 (#1140)
• 8572fc2 chore: bump dependencies and minimum Go to 1.26 (#1149)
• 1251ac3 fix: accept JSON array defaults on array parameters (#1125)
• 07fe841 fix(autopatch): prevent double compression of PATCH responses (#1130)
• c08b653 feat: support string SSE event IDs (#1086)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6b74b2ea-8729-493b-858b-458ad5177f82

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}