Skip to content

Update module github.com/danielgtaylor/huma to v2#71

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github.com-danielgtaylor-huma-2.x
Open

Update module github.com/danielgtaylor/huma to v2#71
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/github.com-danielgtaylor-huma-2.x

Conversation

@renovate

@renovate renovate Bot commented Jan 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
github.com/danielgtaylor/huma v1.14.3 → v2.39.0 age confidence

Release Notes

danielgtaylor/huma (github.com/danielgtaylor/huma)

v2.39.0

Compare Source

v2.39.0
Overview

This release adds a new framework adapter, a handful of developer-facing features, and a large batch of correctness fixes spanning SSE, the Fiber adapter, schema generation, and validation.

Echo v5 Support

The humaecho adapter now supports Echo v5 alongside the existing versions. (#​959)

No More Faulty Duplicate-Schema Panics

Registering operations that use inline structs with differing field names (and an empty operation ID) previously panicked at startup on a false-positive duplicate-schema collision. Conflicting names are now auto-incremented deterministically (Request, Request1, Request2, ...), so the app starts and the generated spec stays readable. (#​893)

Context Propagation to Adapters

WithContext now propagates the context directly into the underlying adapter's own context wrapper (bun, chi, echo, fiber, gin, go, httprouter) instead of relying on a generic sub-context, so cancellation and context values flow correctly through the request lifecycle. (#​867)

SSE Streaming on Fiber / fasthttp

Server-Sent Events (and other streaming responses) previously failed on the Fiber adapters with unable to flush, since fasthttp doesn't implement http.Flusher. SSE now streams correctly on Fiber v2 and v3 via an internal streaming hook, with no new public API and fasthttp remaining an indirect dependency. (#​1059)

More SSE Improvements
  • Response headers are now flushed before the user handler runs, so EventSource.onopen fires immediately rather than waiting for the first event (#​1038)
  • Comments can now be sent over SSE streams, a common way to keep connections alive (#​1054)
New Features
  • Schema.Const for pinning a schema to a single allowed value (#​1004)
  • Customizable docs renderer config for finer control over the documentation UI (#​1024)
  • encoding.TextUnmarshaler support for slice query parameters, matching the existing behavior for scalar params (#​1021)
  • Non-file JSON form-data fields: multipart form fields tagged contentType:"application/json" are now unmarshalled and validated (#​1060)
Validation & Schema Fixes
  • Integer enums no longer always fail validation on query/path parameters; numeric enum values are now compared numerically rather than by strict Go type (#​1050)
  • Content-Type validation is now case-insensitive per RFC 9110, so e.g. Application/Json no longer returns 415 (#​1052)
  • Path parameters are always marked required: true in the generated spec, per the OpenAPI specification (#​1011)
  • Prevented a panic (and dropped response) in uniqueItems validation when array items are unhashable types, now returning 422 correctly (#​1045)
  • The json:",inline" tag is now honored for embedding anonymous fields in schemas (#​1006)
  • Hidden route schemas are no longer leaked into the generated spec (#​1032)
Adapter & Robustness Fixes
  • humafiber (v2): corrected EachHeader iteration (it previously invoked the callback once per byte, breaking cookie reads) and switched BodyReader to Body() for automatic request-body decompression (#​1058)
  • autopatch: prevented chi route-context reuse from recursing internal GET sub-requests back into the generated PATCH handler and panicking (#​1049)
  • Fixed a URL parsing panic in getAPIPrefix when server URLs contain template variables like {port} or {version} (#​1027)
  • The read deadline is now cleared after the request body is read, so a slow handler can't cause a background read to time out and cancel the connection context (#​1028)
Docs UI & Documentation
  • Forms are now permitted in the docs UI CSP (#​1036)
  • Added allow-downloads to the Stoplight CSP so the Export button works (#​1048)
  • Updated Restish references to v2 (#​1041)
What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.38.0...v2.39.0

v2.38.0

Compare Source

Overview

Fiber v3

This release adds support for Fiber v3. Dedicated v2 functions have been added to ensure support for both.

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.37.3...v2.38.0

v2.37.3

Compare Source

Overview

This bugfix release fixes a few minor bugs and typos from previous releases.

This also adjusts the HTTP status code returned by Huma if marshaling a response fails, from 200 to 500.

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.37.2...v2.37.3

v2.37.2

Compare Source

Overview

This bugfix release fixes an issue with how form data was being documented in OpenAPI.

This also fixes embedded objects with valid JSON tags being incorrectly embedded in the OpenAPI docs.

What's Changed

Full Changelog: danielgtaylor/huma@v2.37.1...v2.37.2

v2.37.1

Compare Source

Overview

This bugfix release fixes an issue regarding the Swagger UI docs renderer, as well as fixes an issue preventing Groups from using the configurable options released in v2.37.1.

This also brings interface constructors to humamux.

What's Changed

Full Changelog: danielgtaylor/huma@v2.37.0...v2.37.1

v2.37.0

Compare Source

Overview

Dropped Explicit IDN-Hostname Validation

This validation unintentionally imported an external library to the base Huma library. Since this was not a requested feature, it has been removed for now. The idn-hostname format value has become an alias for hostname in the meantime.

Operation ID Normalization

Spaces in operation IDs get automatically converted to hyphens now.

Optimizations & Fixed Memory Leak

Various internal operations have been optimized (~7% overall improvement): #​973 (comment)

A memory leak when using MultipartFormFiles has been resolved.

New Configurable Options
Allow Additional Properties By Default

A new config option has been added to allow additional properties by default. This can be set in the API config.

config.AllowAdditionalPropertiesByDefault = true
Fields Optional By Default

A new config option has been added to set fields to optional by default, rather than required by default. This can be set in the API config.

config.FieldsOptionalByDefault = true
Strict Query Parameters

A new config option has been added to forcibly reject unknown query parameters. This can be set in the API config, or per-operation.

config.RejectUnknownQueryParameters = true
Framework & Dependency Updates
  • Upgraded to Go 1.25

What's Changed

Full Changelog: danielgtaylor/huma@v2.36.0...v2.37.0

v2.36.0

Compare Source

Overview

This release is larger than usual. Key changes:

Unique Operation ID Enforcement

Operation IDs are now enforced to be unique, preventing collisions in generated OpenAPI specs. (Fixes #​910)

Native Docs Renderer Support

Native support for Scalar and SwaggerUI alongside the default Stoplight Elements. Configure via config.DocsRenderer = huma.DocsRendererScalar.

Expanded Content-Type Handling
  • Graceful handling when clients omit Content-Type for non-JSON endpoints
  • Support for charset definitions in Content-Type header
  • Updated OpenAPI media types to align with newer standards
  • Validation support for non-JSON request body content types
Form Handling Improvements
  • Form data now required by default for clearer validation behavior
  • Fixed panic when text value sent to FormFile field
Schema & Validation Enhancements
  • Fixed $schema field reusing links for identical objects
  • Fixed duplicate example rendering in some docs renderers
  • Improved $schema URL handling (with docs for disabling it)
  • Extended netip.Addr to support IPv6; added new ip format for v4/v6
  • Fixed incorrect schema generation for arrays
Framework & Dependency Updates
  • Fiber adapter now uses Body() instead of BodyRaw() for automatic decompression
  • Upgraded to Go 1.24

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.35.0...v2.36.0

v2.35.0

Compare Source

Overview

Moved this release as it was incorrectly tagged as v2.34.3.

Improved Error Messaging for Form Pointers

Pointer panic messages now explicitly include “Form” where applicable, making debugging clearer and resolving #​892.

Expanded String Format Support

Added support for duration and idn-hostname string formats, improving schema expressiveness and validation coverage.

Header Parsing Fix

Fixed several subtle issues in header detection that occurred when output fields were slices, arrays, or maps, which could cause headers (notably []*http.Cookie) to be incorrectly applied or documented. The parsing logic now correctly inspects the root type of collection fields and adds support for hidden headers, allowing them to be excluded from generated OpenAPI documentation. These changes resolve multiple long-standing documentation and serialization bugs without introducing new behavior.

What's Changed

New Contributors

Full Changelog: https://github.com/danielgtaylor/huma/compare/v2.34.2...v2.34.3

v2.34.3

Compare Source

v2.34.2

Compare Source

Overview

TLS-Aware URL Scheme Detection

Huma now correctly uses the https URL scheme when TLS is configured, and http when it is not. Previously, the scheme detection could be incorrect in certain scenarios.

Time Wrapper Parsing Fix

Fixed an issue where time wrapper types failed to parse correctly, resolving #​844.

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.34.1...v2.34.2

v2.34.1

Compare Source

Overview

This bugfix release fixes an issue regarding content types that was inadvertently introduced while adding a feature in v2.34.0. The previous behavior is restored while still supporting the new feature.

What's Changed

Full Changelog: danielgtaylor/huma@v2.34.0...v2.34.1

v2.34.0

Compare Source

Overview

Opt-in for 406 Errors

By default, Huma will fall back to the default format when content negotiation fails to find an appropriate content type that both the client and server can agree on. This enables clients which send no Content-Type header to Just Work ™️, however sometimes that behavior is not desired and you would rather return a 406 Not Acceptable. A new configuration option enables this:

config := huma.DefaultConfig("My API", "1.0.0")
config.NoFormatFallback = true

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.33.0...v2.34.0

v2.33.0

Compare Source

Overview

Minimum Go Version Upgrade

Go 1.23+ is now required, keeping to the "last two versions" approach that Go itself uses for support. Dependencies have also been upgraded, including a few dependabots for security issues.

Explicitly Set Empty Example

You can now explicitly set empty example strings:

type MyInput struct {
	MyField string `json:"my_field" example:""`
}
Empty Group Path

It's now possible to use operations on a group with an empty path, having the operation use the group's path without any additions:

grp := huma.NewGroup(api, "/users")

huma.Get(grp, "", func(ctx context.Context, input *struct{}) (*struct{}, error) {
	return nil, nil
})
Adapter Context Unwrapping Fixes

You can now use huma.WithValue and huma.WithContext to wrap a context and the adapter-specific Unwrap function will no longer panic.

subctx := huma.WithValue(ctx, key, "value")
r, w := humago.Unwrap(subctx)
Nested CLI Options

Nested CLI options via structs are now supported.

type DatabaseConfig struct {
    Host     string `doc:"Database host"`
    Port     int    `doc:"Database port" default:"5432"`
    Username string `doc:"Database username"`
}

type AppConfig struct {
    Debug bool            `doc:"Enable debug mode"`
    DB    *DatabaseConfig `doc:"Database configuration"` // Here both ptr or direct would have been acceptable.
}

Results in options like --db.host localhost and --db.port 5432.

Other

Various other fixes and feature improvements. Thanks everyone!

What's Changed

New Contributors

Full Changelog: danielgtaylor/huma@v2.32.0...v2.33.0

v2.32.0

Compare Source

Overview
HTTP HEAD Convenience Function

A convenience function was added for HTTP HEAD requests.

huma.Head(api, "/path", handler)
Stop HTML-Escaping JSON

HTTP API usage would rarely need to HTML-escape responses, so this default JSON marshaling behavior has been turned off. If you would like to keep the behavior, you can do so by modifying the huma.Config.Formats map. For example, error messages are now more readable:

  • Before: expected number \u003e= 10
  • After: expected number >= 10
Better Integer Validation

A new validation check has been added to present a better error message to the user when an integer is required but a floating point value like 1.5 is passed in. This now results in an expected integer message instead of a JSON unmarshal error.

Groups + Convenience Function Improvements

Groups and convenience functions like huma.Get now play better together. Groups will regenerate the operation ID and operation summary iff those values were auto-generated and have not been modified. This works for groups of groups as well. The following are equivalent:

huma.Get(api, "/v1/users/", handler)

v1 := huma.NewGroup(api, "/v1")
users := huma.NewGroup(v1, "/users")
huma.Get(users, "/", handler)

fmt.Println(api.OpenAPI().Paths["/v1/users/"].Summary)
// Output: Get v1 users

If you prefer full control over the operation ID and summary, use huma.Register instead. You can still use group operation modifiers and convenience modifiers which modify the operation ID and/or summary and, if modified, they will not get regenerated. You can also disable generation by changing or unsetting the operation's _convenience_id and _convenience_summary metadata fields which are added by convenience functions like huma.Get/huma.Put/etc.

What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.31.0...v2.32.0

v2.31.0

Compare Source

Overview
Go 1.24 omitzero Support!

Huma now supports Go's new JSON omitzero feature out of the box, treating it similar to the existing omitempty in terms of making fields optional. The updated rules for optional fields now look like this:

  1. Start with all fields required.
  2. If a field has omitempty, it is optional.
  3. If a field has omitzero, it is optional.
  4. If a field has required:"false", it is optional.
  5. If a field has required:"true", it is required.

See https://huma.rocks/features/request-validation/#optional-required for more info.

What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.30.0...v2.31.0

v2.30.0

Compare Source

Overview
Sponsors

A big thank you to our new sponsor:

Groups

Huma now supports groups, which port over much of the functionality from @​cardinalby's excellent https://github.com/cardinalby/hureg library (thank you for that work!). This enables creating groups of operations with the same path prefixes, middleware, operation modifiers, and transformers. Typical usage might look like this:

grp := huma.NewGroup(api, "/v1")
grp.UseMiddleware(authMiddleware)

// Register a `GET /v1/users` route that requires auth.
huma.Get(grp, "/users", func(ctx context.Context, input *struct{}) (*UsersResponse, error) {
	// ...
})

See https://huma.rocks/features/groups/ for more details.

Context Unwrapping

Due to many user requests, it is now possible to "unwrap" a router-specific context into its constituent router-specific representation. Each adapter package now has an Unwrap(huma.Context) T function that will return either a request/response pair or that router's own context type, allowing you to effectively escape Huma in router-agnostic middleware & resolvers.

[!CAUTION]
You must use the same adapter package to create the API and call Unwrap or Huma will panic!

Example usage:

router := http.NewServeMux()
api := humago.New(router, huma.DefaultConfig("My API", "1.0.0"))

api.UseMiddleware(func(ctx huma.Context, next func(huma.Context)) {
	r, w := humago.Unwrap(ctx)

	// Do something with the request/response.
	// ...

	next(ctx)
})

While generally not recommended, this can help you to use router-specific middleware as you migrate large existing projects to Huma, or just escape Huma's abstractions when they no longer make sense for your use-case. Sometimes the best library is the one that gets out of the way.

See https://huma.rocks/features/middleware/#unwrapping for more details.

What's Changed
New Contributors

Full Changelog: danielgtaylor/huma@v2.29.0...v2.30.0

v2.29.0

Compare Source

Overview
Support More Multipart Form Values

This enabled the use of fields with arbitrary types in the form which will get parsed & validated for you:

huma.Register(api, huma.Operation{
	OperationID: "upload-and-decode-files"
	Method:      http.MethodPost,
	Path:        "/upload",
}, func(ctx context.Context, input *struct {
	RawBody huma.MultipartFormFiles[struct {
		MyFile                    huma.FormFile   `form:"file" contentType:"text/plain" required:"true"`
		SomeOtherFiles            []huma.FormFile `form:"other-files" contentType:"text/plain" required:"true"`
		NoTagBindingFile          huma.FormFile   `contentType:"text/plain"`
		MyGreeting                string          `form:"greeting", minLength:"6"`
		SomeNumbers               []int           `form:"numbers"`
		NonTaggedValuesAreIgnored string  // ignored
	}]
}) (*struct{}, error) {
	// ...
})
Better Auto-patch Support with Sub-routers

The auto-patch functionality now tries to find a common path prefix so it's possible to do stuff like this and have the generated PATCH operation function correctly:

func main() {
    router := chi.NewRouter()
    router.Route("/api", apiMux())
    err = http.ListenAndServe(fmt.Sprintf(":%d", 8080), router)
}

// apiMux returns a function that initializes the API routes
func apiMux() func(chi.Router) {
        return func(router chi.Router) {
            humaConfig := huma.DefaultConfig("API", "dev")
            humaConfig = openapi.WithAuthSchemes(humaConfig)
            humaConfig = openapi.WithOverviewDoc(humaConfig)
            humaConfig = openapi.WithServers(humaConfig, config)
            api := humachi.New(router, humaConfig)
            huma.Register(api, huma.Operation{
                Method:      "GET",
                Path:        "/ressources/{id}",
            }, getRessourceByID)
            huma.Register(api, huma.Operation{
                Method:      "PUT",
                Path:        "/ressources/{id}",
            }, updateRessourceByID)
            autopatch.AutoPatch(api)
    }
}
Custom Param Type Enhancements

Two new interfaces enable some additional advanced customization enhancements when creating operation input parameters:

type ParamWrapper interface {
	Receiver() reflect.Value
}

type ParamReactor interface {
	OnParamSet(isSet bool, parsed any)
}

These can be used like so:

type OptionalParam[T any] struct {
	Value T
	IsSet bool
}

// Define schema to use wrapped type
func (o OptionalParam[T]) Schema(r huma.Registry) *huma.Schema {
	return huma.SchemaFromType(r, reflect.TypeOf(o.Value))
}

// Expose wrapped value to receive parsed value from Huma
// MUST have pointer receiver
func (o *OptionalParam[T]) Receiver() reflect.Value {
	return reflect.ValueOf(o).Elem().Field(0)
}

// React to request param being parsed to update internal state
// MUST have pointer receiver
func (o *OptionalParam[T]) OnParamSet(isSet bool, parsed any) {
	o.IsSet = isSet
}
Fix Panic from External Schema

It's possible to use the default schema transformers now with custom external schemas without causing a panic. For example:

Responses: map[string]*huma.Response{
    "200": {
        Content: map[string]*huma.MediaType{
            "application/json": {
                Schema: &huma.Schema{
                    Ref: "https://json-schema.org/draft/2020-12/schema",
                },
            },
        },
    },
},

Note: external schemas are not validated and are just there for informational purposes and to help with client generation.

Fiber Fixes

A major rework of the humafiber adapter was done in #​725. This ensures tests are run with the -race detector and fixes a race that was present in the Fiber adapter. It should be much more stable now.

Deep Object Support for Params

Params now support the OpenAPI deepObject style, enabling e.g. query params to send structured input in that style.

// GreetingOutput represents the greeting operation response.
type GreetingOutput struct {
	Body struct {
		Person Person            `json:"person"`
		Map    map[string]string `json:"map"`
	}
}

type Person struct {
	Name     string `json:"name"`
	Age      int    `json:"age,omitempty" default:"20"`
	Birthday string `json:"birthday,omitempty"`
}

func main() {
	// Create a new router & API
	router := chi.NewMux()
	api := humachi.New(router, huma.DefaultConfig("My API", "1.0.0"))

	// Register GET /greeting
	huma.Get(api, "/greeting", func(ctx context.Context, input *struct {
		Person Person            `query:"person,deepObject"`
		Map    map[string]string `query:"map,deepObject"`
	}) (*GreetingOutput, error) {
		out := &GreetingOutput{}
		out.Body.Person = input.Person
		out.Body.Map = input.Map
		return out, nil
	})

	// Start the server!
	log.Println("http://127.0.0.1:8888/docs")
	http.ListenAndServe("127.0.0.1:8888", r

> ✂ **Note**
> 
> PR body was truncated to here.


</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/undg/pulse-remote).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi43NC41IiwidXBkYXRlZEluVmVyIjoiNDMuMjc1LjIiLCJ0YXJnZXRCcmFuY2giOiJtYXN0ZXIiLCJsYWJlbHMiOltdfQ==-->

@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 4 times, most recently from ec18dee to 65e6997 Compare January 18, 2026 18:36
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 2 times, most recently from bc7c6a4 to 5a66947 Compare January 24, 2026 17:44
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from 5a66947 to 63635f1 Compare March 1, 2026 10:28
@renovate

renovate Bot commented Mar 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 3 additional dependencies were updated

Details:

Package Change
github.com/mattn/go-isatty v0.0.20 -> v0.0.22
github.com/stretchr/testify v1.10.0 -> v1.11.1
golang.org/x/sys v0.33.0 -> v0.45.0

@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from 63635f1 to 6d818bd Compare March 26, 2026 05:18
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 3 times, most recently from 206e560 to e29e068 Compare April 7, 2026 03:37
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from e29e068 to 7c2d6d5 Compare April 16, 2026 23:58
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 3 times, most recently from a623168 to ccbbd43 Compare May 15, 2026 13:25
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch 5 times, most recently from 11ae670 to f72199a Compare July 17, 2026 16:00
@renovate
renovate Bot force-pushed the renovate/github.com-danielgtaylor-huma-2.x branch from f72199a to 54f7066 Compare July 25, 2026 00:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants