[dependabot]

Bumps github.com/oapi-codegen/runtime from 1.8.0 to 1.9.0.

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

v1.9.0: Slimmer dependencies and a pluggable JSON codec

This release removes the strictmiddleware packages, which pulled every supported web framework into the dependency graph of every program that imports the runtime, and which generated code has not used since oapi-codegen v2.7.0. It adds a process-wide JSON codec that the upcoming oapi-codegen v2.9.0 will route all generated JSON encoding and decoding through, binds uuid.UUID fields in deepObject parameters, and fixes label and matrix path parameters whose value contains the style's delimiter. The minimum Go version is now 1.26.

Notable Changes

☢️ Breaking: the strictmiddleware packages are gone

The strictmiddleware/{echo,echo-v5,gin,iris,nethttp} packages held a handful of StrictHandlerFunc and StrictMiddlewareFunc type definitions, and nothing else. To define them, the runtime had to import Echo, Gin and Iris, so every program importing github.com/oapi-codegen/runtime dragged all three frameworks and their transitive dependencies into its go.mod, whether it used them or not. Removing the packages (#181, closes #180) takes the root module from 5 direct and 66 indirect requirements down to 4 direct and 1 indirect, with no web framework among them. The separate strictmiddleware/echo-v5 module is removed as well.

Code generated by oapi-codegen v2.7.0 and later declares these types itself and never imports the packages, so for anyone on a current generator the upgrade is a go get and a go mod tidy that deletes a lot of lines. Code generated by oapi-codegen v2.6.0 or earlier still imports them and will not compile against this release.

[!IMPORTANT] If your project uses generated code from oapi-codegen v2.6.0 or earlier, stay on runtime v1.8.0 until you have regenerated with v2.7.0 or later. Do not upgrade the runtime first.

Pluggable JSON codec

Everything the runtime encodes or decodes as JSON now goes through a single, process-wide codec (#183). The default is encoding/json, unchanged, and a program can replace it in its main package:

runtime.SetJSONCodec(myCodec) // any value with Marshal(any) ([]byte, error) and Unmarshal([]byte, any) error

The API is:

• JSONCodec: the two-method interface a replacement implements. StdJSONCodec is encoding/json's pair, and can be embedded to override just one method, for instance to turn off HTML escaping.
• StreamingJSONCodec: an optional second interface, MarshalWrite(io.Writer, any) and UnmarshalRead(io.Reader, any), for codecs that can stream request and response bodies instead of buffering them. A codec without it is buffered through Marshal and Unmarshal.
• JSONMarshal, JSONUnmarshal, JSONMarshalWrite and JSONUnmarshalRead: the functions that generated code and the runtime itself call. JSONUnmarshalRead returns io.EOF for an empty body whichever codec is in use, which is how strict servers detect an optional body that was left out.
• SetJSONCodec(nil) restores the default.

Within the runtime, deepObject and form parameter encoding, BindJSONBody, and the types package's Date, Duration, Email and File all use the codec already. Generated code still calls encoding/json directly today. oapi-codegen v2.9.0 will switch every generated json.Marshal, json.Unmarshal and strict response encoder over to these functions, at which point one SetJSONCodec call covers a whole program: models, clients and servers. This replaces the per-package json-encoding configuration proposed in oapi-codegen/oapi-codegen#2371, where the design discussion lives, and it is the intended path to encoding/json/v2. Thanks to @​CRaLFa for the implementation.

uuid.UUID fields bind in deepObject parameters

A deepObject query parameter with a format: uuid field, such as ?filter[entity]=6ba7b810-9dad-11d1-80b4-00c04fd430c8, failed with unhandled type: uuid.UUID. uuid.UUID is a [16]byte, so it never reached the branch that checks for encoding.TextUnmarshaler. Array-kind types that implement UnmarshalText now bind, as they already did everywhere else in the runtime; uuid.UUID, *uuid.UUID, slices and map values all work. Other fixed-size arrays are still rejected as before. Thanks to @​youdie006 (#171).

label and matrix scalar path parameters are no longer split

A scalar label or matrix path parameter whose value contained the style's delimiter, such as big,red sent as .big%2Cred, was rejected with "expected single value, got N parts" once the router had decoded the segment. The primitive branch now strips only the style prefix and never splits the value, matching the fix #114 made for the simple style. Arrays, structs and maps are unchanged (#182, closes #175).

Go 1.26

The module now requires Go 1.26, the oldest supported Go release, and all remaining dependencies are at their latest versions (#178).

☢️ Breaking changes

• Remove strictmiddleware type definitions (#181) @​mromaszewicz

🚀 New features and improvements

• fix: bind uuid.UUID fields in deepObject parameters (#171) @​youdie006

... (truncated)

Commits

• 1b74ca8 fix: bind uuid.UUID fields in deepObject parameters (#171)
• 171731d Remove strictmiddleware type definitions (#181)
• 2de32b1 feat: add process-wide JSON codec (#183)
• 754d5c0 Stop splitting label and matrix scalar path parameters (#182)
• 108a45d Update Go to 1.26 and all dependencies to their latest versions (#178)
• ce3e04f fix(deps): update module github.com/gin-gonic/gin to v1.11.0 (#168)
• b2e1019 fix(deps): update module github.com/oapi-codegen/nullable to v1.2.0 (#169)
• 694cd4a chore(deps): update module github.com/klauspost/compress to v1.18.7 [security...
• a99390d fix(deps): update module github.com/stretchr/testify to v1.12.1 (#170)
• e8d61e2 fix(deps): update module github.com/labstack/echo/v5 to v5.4.4 (#172)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[augmentcode]

^{Deep Code Review Agent🐛}

Review completed with 0 suggestions.

_{Reviewed commit: 4c63f0e}