Skip to content

Update module github.com/danielgtaylor/huma to v2 - #71

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github.com-danielgtaylor-huma-2.x
Open

Update module github.com/danielgtaylor/huma to v2#71
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github.com-danielgtaylor-huma-2.x

Conversation

@renovate

@renovate renovate Bot commented Jan 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/danielgtaylor/huma v1.14.3 → v2.39.1 age confidence

Release Notes

danielgtaylor/huma (github.com/danielgtaylor/huma)

v2.39.1

Compare Source

v2.39.1
Overview

A patch release: correctness fixes for resolvers, validation, and response handling, plus a dependency refresh.

Response Status Visible to Middleware Again

WithContext context propagation in v2.39.0 copied the response status by value, so middleware that called WithContext and then read Status() after next() always saw 0 instead of the status the handler set, breaking access logging and telemetry. The status is now shared by every context copy across all adapters, restoring the pre-2.39 invariant while keeping context propagation intact. (#​1081)

Resolvers & Defaults in Arrays and Maps
  • Nested resolvers now run for fixed-size arrays ([2]Item), not just slices (#​1076)
  • A resolver on a named collection type (e.g. type Coords [2]float64) no longer panics, and is no longer conflated with a resolver on its element type, which previously ran the element's resolver twice and the collection's never (#​1082)
  • Values reached through a map are now written back after being walked, so applying a default no longer panics with reflect: reflect.Value.Set using unaddressable value and resolver mutations are no longer silently discarded (#​1082)
Stricter email and uri Formats

Validation for two string formats is tighter, so payloads that previously passed may now return 422:

  • email / idn-email accept an addr-spec only; full mailbox forms with a display name (Name <user@example.com>) are rejected
  • uri / iri require an absolute URI with a non-empty scheme, while relative references remain valid under uri-reference / iri-reference (#​1068)
Validation Robustness
  • An unresolvable schema $ref during Validate now reports expected schema $ref to resolve: ... instead of panicking on a nil dereference, covering discriminators and map[string]any / map[any]any values (#​1065)
  • Named numeric slice parameters (e.g. type IDs []int64) are built with their declared element type and validated with item, length, and uniqueness constraints intact (#​1074)
Other Fixes
  • Resolver errors that wrap a HeadersError now contribute their headers to the response, matching the handler error path (#​1070)
  • A nil interface response body no longer panics in the schema link transformer (#​1072)
  • Dependencies updated (#​1066)
What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.39.0...v2.39.1

v2.39.0

Compare Source

v2.39.0
Overview

This release adds a new framework adapter, a handful of developer-facing features, and a large batch of correctness fixes spanning SSE, the Fiber adapter, schema generation, and validation.

Echo v5 Support

The humaecho adapter now supports Echo v5 alongside the existing versions. (#​959)

No More Faulty Duplicate-Schema Panics

Registering operations that use inline structs with differing field names (and an empty operation ID) previously panicked at startup on a false-positive duplicate-schema collision. Conflicting names are now auto-incremented deterministically (Request, Request1, Request2, ...), so the app starts and the generated spec stays readable. (#​893)

Context Propagation to Adapters

WithContext now propagates the context directly into the underlying adapter's own context wrapper (bun, chi, echo, fiber, gin, go, httprouter) instead of relying on a generic sub-context, so cancellation and context values flow correctly through the request lifecycle. (#​867)

SSE Streaming on Fiber / fasthttp

Server-Sent Events (and other streaming responses) previously failed on the Fiber adapters with unable to flush, since fasthttp doesn't implement http.Flusher. SSE now streams correctly on Fiber v2 and v3 via an internal streaming hook, with no new public API and fasthttp remaining an indirect dependency. (#​1059)

More SSE Improvements
  • Response headers are now flushed before the user handler runs, so EventSource.onopen fires immediately rather than waiting for the first event (#​1038)
  • Comments can now be sent over SSE streams, a common way to keep connections alive (#​1054)
New Features
  • Schema.Const for pinning a schema to a single allowed value (#​1004)
  • Customizable docs renderer config for finer control over the documentation UI (#​1024)
  • encoding.TextUnmarshaler support for slice query parameters, matching the existing behavior for scalar params (#​1021)
  • Non-file JSON form-data fields: multipart form fields tagged contentType:"application/json" are now unmarshalled and validated (#​1060)
Validation & Schema Fixes
  • Integer enums no longer always fail validation on query/path parameters; numeric enum values are now compared numerically rather than by strict Go type (#​1050)
  • Content-Type validation is now case-insensitive per RFC 9110, so e.g. Application/Json no longer returns 415 (#​1052)
  • Path parameters are always marked required: true in the generated spec, per the OpenAPI specification (#​1011)
  • Prevented a panic (and dropped response) in uniqueItems validation when array items are unhashable types, now returning 422 correctly (#​1045)
  • The json:",inline" tag is now honored for embedding anonymous fields in schemas (#​1006)
  • Hidden route schemas are no longer leaked into the generated spec (#​1032)
Adapter & Robustness Fixes
  • humafiber (v2): corrected EachHeader iteration (it previously invoked the callback once per byte, breaking cookie reads) and switched BodyReader to Body() for automatic request-body decompression (#​1058)
  • autopatch: prevented chi route-context reuse from recursing internal GET sub-requests back into the generated PATCH handler and panicking (#​1049)
  • Fixed a URL parsing panic in getAPIPrefix when server URLs contain template variables like {port} or {version} (#​1027)
  • The read deadline is now cleared after the request body is read, so a slow handler can't cause a background read to time out and cancel the connection context (#​1028)
Docs UI & Documentation
  • Forms are now permitted in the docs UI CSP (#​1036)
  • Added allow-downloads to the Stoplight CSP so the Export button works (#​1048)
  • Updated Restish references to v2 (#​1041)
What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.38.0...v2.39.0

v2.38.0

Compare Source

Overview

Fiber v3

This release adds support for Fiber v3. Dedicated v2 functions have been added to ensure support for both.

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.37.3...v2.38.0

v2.37.3

Compare Source

Overview

This bugfix release fixes a few minor bugs and typos from previous releases.

This also adjusts the HTTP status code returned by Huma if marshaling a response fails, from 200 to 500.

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.37.2...v2.37.3

v2.37.2

Compare Source

Overview

This bugfix release fixes an issue with how form data was being documented in OpenAPI.

This also fixes embedded objects with valid JSON tags being incorrectly embedded in the OpenAPI docs.

What's Changed

Full Changelog: danielgtaylor/huma@v2.37.1...v2.37.2

v2.37.1

Compare Source

Overview

This bugfix release fixes an issue regarding the Swagger UI docs renderer, as well as fixes an issue preventing Groups from using the configurable options released in v2.37.1.

This also brings interface constructors to humamux.

What's Changed

Full Changelog: danielgtaylor/huma@v2.37.0...v2.37.1

v2.37.0

Compare Source

Overview

Dropped Explicit IDN-Hostname Validation

This validation unintentionally imported an external library to the base Huma library. Since this was not a requested feature, it has been removed for now. The idn-hostname format value has become an alias for hostname in the meantime.

Operation ID Normalization

Spaces in operation IDs get automatically converted to hyphens now.

Optimizations & Fixed Memory Leak

Various internal operations have been optimized (~7% overall improvement): #​973 (comment)

A memory leak when using MultipartFormFiles has been resolved.

New Configurable Options
Allow Additional Properties By Default

A new config option has been added to allow additional properties by default. This can be set in the API config.

config.AllowAdditionalPropertiesByDefault = true
Fields Optional By Default

A new config option has been added to set fields to optional by default, rather than required by default. This can be set in the API config.

config.FieldsOptionalByDefault = true
Strict Query Parameters

A new config option has been added to forcibly reject unknown query parameters. This can be set in the API config, or per-operation.

config.RejectUnknownQueryParameters = true
Framework & Dependency Updates
  • Upgraded to Go 1.25

What's Changed

Full Changelog: danielgtaylor/huma@v2.36.0...v2.37.0

v2.36.0

Compare Source

Overview

This release is larger than usual. Key changes:

Unique Operation ID Enforcement

Operation IDs are now enforced to be unique, preventing collisions in generated OpenAPI specs. (Fixes #​910)

Native Docs Renderer Support

Native support for Scalar and SwaggerUI alongside the default Stoplight Elements. Configure via config.DocsRenderer = huma.DocsRendererScalar.

Expanded Content-Type Handling
  • Graceful handling when clients omit Content-Type for non-JSON endpoints
  • Support for charset definitions in Content-Type header
  • Updated OpenAPI media types to align with newer standards
  • Validation support for non-JSON request body content types
Form Handling Improvements
  • Form data now required by default for clearer validation behavior
  • Fixed panic when text value sent to FormFile field
Schema & Validation Enhancements
  • Fixed $schema field reusing links for identical objects
  • Fixed duplicate example rendering in some docs renderers
  • Improved $schema URL handling (with docs for disabling it)
  • Extended netip.Addr to support IPv6; added new ip format for v4/v6
  • Fixed incorrect schema generation for arrays
Framework & Dependency Updates
  • Fiber adapter now uses Body() instead of BodyRaw() for automatic decompression
  • Upgraded to Go 1.24

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.35.0...v2.36.0

v2.35.0

Compare Source

Overview

Moved this release as it was incorrectly tagged as v2.34.3.

Improved Error Messaging for Form Pointers

Pointer panic messages now explicitly include “Form” where applicable, making debugging clearer and resolving #​892.

Expanded String Format Support

Added support for duration and idn-hostname string formats, improving schema expressiveness and validation coverage.

Header Parsing Fix

Fixed several subtle issues in header detection that occurred when output fields were slices, arrays, or maps, which could cause headers (notably []*http.Cookie) to be incorrectly applied or documented. The parsing logic now correctly inspects the root type of collection fields and adds support for hidden headers, allowing them to be excluded from generated OpenAPI documentation. These changes resolve multiple long-standing documentation and serialization bugs without introducing new behavior.

What's Changed

New Contributors

Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.34.2...v2.34.3

v2.34.3

Compare Source

v2.34.2

Compare Source

Overview

TLS-Aware URL Scheme Detection

Huma now correctly uses the https URL scheme when TLS is configured, and http when it is not. Previously, the scheme detection could be incorrect in certain scenarios.

Time Wrapper Parsing Fix

Fixed an issue where time wrapper types failed to parse correctly, resolving #​844.

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.34.1...v2.34.2

v2.34.1

Compare Source

Overview

This bugfix release fixes an issue regarding content types that was inadvertently introduced while adding a feature in v2.34.0. The previous behavior is restored while still supporting the new feature.

What's Changed

Full Changelog: danielgtaylor/huma@v2.34.0...v2.34.1

v2.34.0

Compare Source

Overview

Opt-in for 406 Errors

By default, Huma will fall back to the default format when content negotiation fails to find an appropriate content type that both the client and server can agree on. This enables clients which send no Content-Type header to Just Work ™️, however sometimes that behavior is not desired and you would rather return a 406 Not Acceptable. A new configuration option enables this:

config := huma.DefaultConfig("My API", "1.0.0")
config.NoFormatFallback = true

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.33.0...v2.34.0

v2.33.0

Compare Source

Overview

Minimum Go Version Upgrade

Go 1.23+ is now required, keeping to the "last two versions" approach that Go itself uses for support. Dependencies have also been upgraded, including a few dependabots for security issues.

Explicitly Set Empty Example

You can now explicitly set empty example strings:

type MyInput struct {
	MyField string `json:"my_field" example:""`
}
Empty Group Path

It's now possible to use operations on a group with an empty path, having the operation use the group's path without any additions:

grp := huma.NewGroup(api, "/users")

huma.Get(grp, "", func(ctx context.Context, input *struct{}) (*struct{}, error) {
	return nil, nil
})
Adapter Context Unwrapping Fixes

You can now use huma.WithValue and huma.WithContext to wrap a context and the adapter-specific Unwrap function will no longer panic.

subctx := huma.WithValue(ctx, key, "value")
r, w := humago.Unwrap(subctx)
Nested CLI Options

Nested CLI options via structs are now supported.

type DatabaseConfig struct {
    Host     string `doc:"Database host"`
    Port     int    `doc:"Database port" default:"5432"`
    Username string `doc:"Database username"`
}

type AppConfig struct {
    Debug bool            `doc:"Enable debug mode"`
    DB    *DatabaseConfig `doc:"Database configuration"` // Here both ptr or direct would have been acceptable.
}

Results in options like --db.host localhost and --db.port 5432.

Other

Various other fixes and feature improvements. Thanks everyone!

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.32.0...v2.33.0

v2.32.0

Compare Source

Overview
HTTP HEAD Convenience Function

A convenience function was added for HTTP HEAD requests.

huma.Head(api, "/path", handler)
Stop HTML-Escaping JSON

HTTP API usage would rarely need to HTML-escape responses, so this default JSON marshaling behavior has been turned off. If you would like to keep the behavior, you can do so by modifying the huma.Config.Formats map. For example, error messages are now more readable:

  • Before: expected number \u003e= 10
  • After: expected number >= 10
Better Integer Validation

A new validation check has been added to present a better error message to the user when an integer is required but a floating point value like 1.5 is passed in. This now results in an expected integer message instead of a JSON unmarshal error.

Groups + Convenience Function Improvements

Groups and convenience functions like huma.Get now play better together. Groups will regenerate the operation ID and operation summary iff those values were auto-generated and have not been modified. This works for groups of groups as well. The following are equivalent:

huma.Get(api, "/v1/users/", handler)

v1 := huma.NewGroup(api, "/v1")
users := huma.NewGroup(v1, "/users")
huma.Get(users, "/", handler)

fmt.Println(api.OpenAPI().Paths["/v1/users/"].Summary)
// Output: Get v1 users

If you prefer full control over the operation ID and summary, use huma.Register instead. You can still use group operation modifiers and convenience modifiers which modify the operation ID and/or summary and, if modified, they will not get regenerated. You can also disable generation by changing or unsetting the operation's _convenience_id and _convenience_summary metadata fields which are added by convenience functions like huma.Get/huma.Put/etc.

What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.31.0...v2.32.0

v2.31.0

Compare Source

Overview
Go 1.24 omitzero Support!

Huma now supports Go's new JSON omitzero feature out of the box, treating it similar to the existing omitempty in terms of making fields optional. The updated rules for optional fields now look like this:

  1. Start with all fields required.
  2. If a field has omitempty, it is optional.
  3. If a field has omitzero, it is optional.
  4. If a field has required:"false", it is optional.
  5. If a field has required:"true", it is required.

See https://huma.rocks/features/request-validation/#optional-required for more info.

What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.30.0...v2.31.0

v2.30.0

Compare Source

Overview
Sponsors

A big thank you to our new sponsor:

Groups

Huma now supports groups, which port over much of the functionality from @​cardinalby's excellent https://github.com/cardinalby/hureg library (thank you for that work!). This enables creating groups of operations with the same path prefixes, middleware, operation modifiers, and transformers. Typical usage might look like this:

grp := huma.NewGroup(api, "/v1")
grp.UseMiddleware(authMiddleware)

// Register a `GET /v1/users` route that requires auth.
huma.Get(grp, "/users", func(ctx context.Context, input *struct{}) (*UsersResponse, error) {
	// ...
})

See https://huma.rocks/features/groups/ for more details.

Context Unwrapping

Due to many user requests, it is now possible to "unwrap" a router-specific context into its constituent router-specific representation. Each adapter package now has an Unwrap(huma.Context) T function that will return either a request/response pair or that router's own context type, allowing you to effectively escape Huma in router-agnostic middleware & resolvers.

[!CAUTION]
You must use the same adapter package to create the API and call Unwrap or Huma will panic!

Example usage:

router := http.NewServeMux()
api := humago.New(router, huma.DefaultConfig("My API", "1.0.0"))

api.UseMiddleware(func(ctx huma.Context, next func(huma.Context)) {
	r, w := humago.Unwrap(ctx)

	// Do something with the request/response.
	// ...

	next(ctx)
})

While generally not recommended, this can help you to use router-specific middleware as you migrate large existing projects to Huma, or just escape Huma's abstractions when they no longer make sense for your use-case. Sometimes the best library is the one that gets out of the way.

See https://huma.rocks/features/middleware/#unwrapping for more details.

What's Changed
New Contributors

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 4 times, most recently from ec18dee to 65e6997 Compare January 18, 2026 18:36
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 2 times, most recently from bc7c6a4 to 5a66947 Compare January 24, 2026 17:44
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from 5a66947 to 63635f1 Compare March 1, 2026 10:28
@renovate

renovate Bot commented Mar 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
github.com/mattn/go-colorable v0.1.14 -> v0.1.15
github.com/mattn/go-isatty v0.0.20 -> v0.0.23
github.com/stretchr/testify v1.10.0 -> v1.11.1
golang.org/x/sys v0.33.0 -> v0.47.0

@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from 63635f1 to 6d818bd Compare March 26, 2026 05:18
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 3 times, most recently from 206e560 to e29e068 Compare April 7, 2026 03:37
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from e29e068 to 7c2d6d5 Compare April 16, 2026 23:58
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 3 times, most recently from a623168 to ccbbd43 Compare May 15, 2026 13:25
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 5 times, most recently from 11ae670 to f72199a Compare July 17, 2026 16:00
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 9 times, most recently from 6460b0f to ef5b6c4 Compare July 28, 2026 21:53
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 4 times, most recently from e125409 to d1d44fb Compare July 29, 2026 18:27
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from d1d44fb to 2846c41 Compare August 1, 2026 15:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants