fix(deps): update dependency express-openapi-validator to v5

[renovate]

Note: This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
express-openapi-validator	4.13.8 → 5.6.0

---

Release Notes

cdimascio/express-openapi-validator (express-openapi-validator)

v5.6.0

Compare Source

(2025-09-06)

• Add deep discriminator support (#​1106) (0c4fe03), closes #​1106
• Dependency bump for snyk and npm vulnerabilities (#​1099) (99c370c), closes #​1099
• chore(deps): bump cookie and express (#​1029) (e76e354), closes #​1029
• chore(deps): bump form-data from 3.0.1 to 3.0.4 in /examples/9-nestjs (#​1097) (a582000), closes #​1097
• chore(deps): bump multer in /examples/4-eov-operations-babel (#​1091) (4f97239), closes #​1091
• chore(deps): bump on-headers and morgan (#​1094) (167b7e1), closes #​1094
• fix: examples/2-standard-multiple-api-specs/package.json & examples/2-standard-multiple-api-specs/pa (41a3821), closes #​1098
• fix: examples/3-eov-operations/package.json & examples/3-eov-operations/package-lock.json to reduce (574187f), closes #​1095
• fix: examples/4-eov-operations-babel/package.json & examples/4-eov-operations-babel/package-lock.jso (4aab85d), closes #​1100
• fix: upgrade @​types/multer from 1.4.12 to 1.4.13 (#​1092) (ab6d1ab), closes #​1092

(2025-07-27)

• throw provided exception example (d2df3ed)
• throw provided exception example (307cddd)
• v5.5.8 (bcd119e)
• fix: package.json & package-lock.json to reduce vulnerabilities (#​1096) (2fc8a6a), closes #​1096
• chore: upgrade @​apidevtools/json-schema-ref-parser to v14.x (#​1090) (20077d2), closes #​1090
• chore(deps): bump multer and express-openapi-validator (#​1085) (ac16300), closes #​1085

(2025-06-11)

• fix(#​1071): Fix query param validation for literal bracket notation in param names (122ac9d)
• fix(#​1071): Fix query param validation for literal bracket notation in param names (#​1084) (319b303), closes #​1084
• upgrade example to 5.5.6 (0b852b9)
• chore(deps): bump multer in /examples/2-standard-multiple-api-specs (#​1082) (631e4cc), closes #​1082

(2025-06-07)

• allErrors default remains false for >-5 (22ce174)
• allErrors default remains false for >-5 (901c8dd)
• allErrors default remains false for >-5 (0671ed9)
• Delete test.txt (ef8105c)
• fixes #​1037 returns all errors, rather than just the first (8fa449b), closes #​1037
• v5.5.4 (af80f33)
• chore(deps): bump multer and express-openapi-validator (#​1076) (2c3a1e7), closes #​1076
• chore(deps): bump multer from 2.0.0 to 2.0.1 in /examples/1-standard (#​1080) (d1f5ec5), closes #​1080
• fix: examples/1-standard/package.json & examples/1-standard/package-lock.json to reduce vulnerabilit (3810afc), closes #​1074
• fix: examples/2-standard-multiple-api-specs/package.json & examples/2-standard-multiple-api-specs/pa (fc86598), closes #​1075

(2025-05-24)

• chore(deps): bump multer from 1.4.5-lts.2 to 2.0.0 (#​1069) (9426f16), closes #​1069

(2025-05-19)

• v5.5.2 (9f640cf)
• fix: add qs as dependency (#​1067) (eef4922), closes #​1067

(2025-05-18)

• fixes 1064: type: object and explode: false in query parameter is not working as expected (#​1066) (7ff2fee), closes #​1066
• Update README.md (d47f1f6)
• Update README.md (44e2d8f)
• v5.5.1 (306b2ea)

(2025-05-11)

• fix tests for node 24 (e94cb27)
• Optimise Ajv cache usage (#​1062) (990995b), closes #​1062
• Update README.md (218a4b1)
• Update README.md (c500595)
• Update README.md (#​1059) (b24a071), closes #​1059
• v 5.5.0-beta.2 - upgrades dependencies (f2f6c37)
• v5.5.0 (3562d7b)
• v5.5.0 (92f64c7)
• v5.5.0 (81766f1)
• v5.5.0-beta.1 (a52b312)

(2025-04-06)

• allow mutation for express 5 validaiton (#​1043) (a84f611), closes #​1043
• caches pre-processed resolved schemas (85a2920)
• handle req.query mutations for express 5 (2e02653)
• handle req.query mutations for express 5 (86374a3)
• handle req.query mutations for express 5 (1d69d8a)
• handle req.query mutations for express 5 (456b0a8)
• update README (4edacd8)
• Update README.md (5e8e01b)
• Update README.md (f9d6747)
• v5.4.3 (c7d61e4)
• test(express-5): change routes in tests to new path route syntax (#​1036) (536e0b0), closes #​1036

(2025-02-23)

• caches pre-processed resolved schemas (ac02bdf)

(2025-02-09)

• allow mutation for express 5 validaiton (#​1043) (0439224), closes #​1043
• fix test (97158fd)
• Update README.md (405a9ff)
• Update README.md (64582e9)

(2024-12-27)

• re-enable keywords now properly supported (#​1031) (83dac8a), closes #​1031
• update deps (6eb86a6)
• v5.4.2 (c811993)

(2024-12-27)

• fixes method res with path params (#​1032) (aa60f9c), closes #​1032
• Update README.md (d43ec2e)

(2024-12-26)

• update alpha 3.1 version (cba4aac)
• v5.3.9 (75531ae)
• v5.4.0 (34359d0)
• feat(openapi): support OpenAPI version 3.1 (extends PR #​882) (#​1027) (fc876a3), closes #​882 #​1027 #​1009 #​1021 #​1017 #​1016
• fix: examples/4-eov-operations-babel/package.json & examples/4-eov-operations-babel/package-lock.jso (8da3707), closes #​1021
• fix: examples/4-eov-operations-babel/package.json & examples/4-eov-operations-babel/package-lock.jso (f6e6295), closes #​972
• fix: fix authHeader without cookie-parser middleware (#​1003) (17e91d5), closes #​1003 #​949
• fix: package.json & package-lock.json to reduce vulnerabilities (#​1017) (e88a4ef), closes #​1017
• fix: upgrade @​apidevtools/json-schema-ref-parser from 11.7.0 to 11.7.2 (#​1006) (a67802b), closes #​1006
• fix: upgrade express-openapi-validator from 5.3.6 to 5.3.7 (#​1001) (7a8fcc0), closes #​1001
• fix: upgrade express-openapi-validator from 5.3.6 to 5.3.7 (#​1008) (831b648), closes #​1008
• fix: upgrade express-openapi-validator from 5.3.7 to 5.3.8 (#​1011) (65c0e56), closes #​1011
• fix: upgrade path-to-regexp from 8.1.0 to 8.2.0 (#​1000) (ed6a9b7), closes #​1000
• chore(deps): bump cookie and express in /examples/3-eov-operations (#​1002) (f2aba32), closes #​1002
• chore(deps): bump path-to-regexp and express in /examples/1-standard (#​1016) (4a3efff), closes #​1016

(2024-10-30)

• fix: fix authHeader without cookie-parser middleware (#​1003) (17e91d5), closes #​1003 #​949
• chore(deps): bump cookie and express in /examples/3-eov-operations (#​1002) (f2aba32), closes #​1002

(2024-10-26)

• fix: add cookie support for HTTP bearer authentication (#​949) (00d070b), closes #​949
• fix: examples/1-standard/package.json & examples/1-standard/package-lock.json to reduce vulnerabilit (8ce7fda), closes #​986
• fix: examples/2-standard-multiple-api-specs/package.json & examples/2-standard-multiple-api-specs/pa (95f5f5a), closes #​987
• fix: examples/3-eov-operations/package.json & examples/3-eov-operations/package-lock.json to reduce (e81222e), closes #​989
• fix: examples/4-eov-operations-babel/package.json & examples/4-eov-operations-babel/package-lock.jso (263c641), closes #​994
• fix: examples/4-eov-operations-babel/package.json & examples/4-eov-operations-babel/package-lock.jso (e71b5fc), closes #​988
• fix: package.json & package-lock.json to reduce vulnerabilities (#​993) (b6201c3), closes #​993
• fix: upgrade express-openapi-validator from 5.3.6 to 5.3.7 (#​995) (8cee5f9), closes #​995
• Create SECURITY.md (#​999) (5e21e3f), closes #​999
• example 6 enhancements (789b43b)
• Update README.md (946aab8)
• Update README.md (f61c185)
• chore(deps): bump body-parser and @​nestjs/platform-express (#​990) (773f18e), closes #​990
• chore(deps): bump cookie and cookie-parser (#​996) (9bd5177), closes #​996
• chore(deps): bump path-to-regexp (#​997) (e60d146), closes #​997

(2024-09-18)

• fix: upgrade @​types/multer from 1.4.11 to 1.4.12 (#​983) (0fa043e), closes #​983
• feat(path-to-regexp): path-to-regexp 8.1.0 update (#​976) (70cce65), closes #​976

(2024-09-13)

• bodyParsers is deprecated so update with expess bodyParsers (#​974) (6dc3b97), closes #​974
• Update README.md (772d1dc)
• Update README.md (de4219e)
• fix: upgrade express-openapi-validator from 5.2.0 to 5.3.1 (#​960) (bd636bb), closes #​960
• chore(deps-dev): bump braces from 3.0.2 to 3.0.3 in /examples/9-nestjs (#​964) (148fa90), closes #​964
• chore(deps-dev): bump braces in /examples/7-response-date-serialization (#​963) (aa3018a), closes #​963

(2024-09-06)

• fix: Dereference path parameters (#​962) (0aebe5d), closes #​962
• fix: upgrade express-openapi-validator from 5.2.0 to 5.3.1 (#​951) (5b0058d), closes #​951
• [StepSecurity] ci: Harden GitHub Actions (#​959) (78e55be), closes #​959
• Fix changelog breaking changes notice (#​961) (0a8dc2f), closes #​961
• update README (7334ccd)
• chore(deps-dev): bump braces in /examples/5-custom-operation-resolver (#​958) (eda5612), closes #​958
• chore(deps): bump braces in /examples/4-eov-operations-babel (#​957) (749a8c8), closes #​957
• chore(deps): bump webpack and @​nestjs/cli in /examples/9-nestjs (#​953) (299aad6), closes #​953

(2024-08-31)

• Change AJV allErrors default and support user setting (#​955) (392f1dd), closes #​955 #​954
• Update README.md (f20b1c9)
• Use lenient resolver type (#​956) (826ba62), closes #​956 #​921 #​952

breaking change

By default, request and response validation now stops after the first failure. Only one error will be reported even when multiple may exist. This follows best practices from AJV:

• Security risks of trusted schemas
• allErrors option

To report all validation errors (only recommended in development), option allErrors can be set in options validateRequests and/or validateResponses. For example:

app.use(
  OpenApiValidator.middleware({
    apiSpec: 'path/to/openapi.json',
    validateRequests: {
      allErrors: true,
    },
    validateResponses: {
      allErrors: true,
    },
  })
);

(2024-08-24)

• chore(deps-dev): bump @​babel/traverse in /examples/9-nestjs (#​948) (edd054f), closes #​948
• chore(deps-dev): bump braces in /examples/8-top-level-discriminator (#​929) (e3a9526), closes #​929
• chore(deps-dev): bump ws from 7.5.5 to 7.5.10 in /examples/9-nestjs (#​930) (9d5895b), closes #​930
• fix: correct security schema logic for OR verification (#​946) (2265a10), closes #​946
• fix: upgrade @​apidevtools/json-schema-ref-parser from 11.6.4 to 11.7.0 (#​947) (ea4129c), closes #​947
• fix: upgrade ajv from 8.15.0 to 8.17.1 (#​945) (087d8f7), closes #​945
• fix: upgrade express-openapi-validator from 5.1.6 to 5.2.0 (#​944) (f022d21), closes #​944
• version 5.3.2 (4428922)

(2024-08-24)

• fix: correct security schema logic for OR verification (#​946) (2265a10), closes #​946
• fix: upgrade express-openapi-validator from 5.1.6 to 5.2.0 (#​944) (f022d21), closes #​944

(2024-08-05)

• Stripped query params for req.url branch arm (#​942) (26d06c4), closes #​942
• Update LICENSE (20727ff)
• version 5.2.1 (aace73c)
• FIX: issue #​917 (#​935) (8e66d3f), closes #​917 #​935
• fix: upgrade @​apidevtools/json-schema-ref-parser from 11.6.2 to 11.6.4 (#​937) (f148eeb), closes #​937
• fix: upgrade ajv from 8.14.0 to 8.15.0 (#​938) (a1ea81f), closes #​938
• fix: upgrade express-openapi-validator from 5.1.6 to 5.2.0 (#​936) (2d75db4), closes #​936
• chore(deps-dev): bump braces from 3.0.2 to 3.0.3 (#​928) (093bd3c), closes #​928

(2024-06-02)

• Add express as peer dependency (#​907) (4e8bc84), closes #​907
• Add multipart fix when does not exist any body (#​905) (5c98d17), closes #​905
• add reponse serializer tests for arrays (bbbd160)
• pass coerceTypes through (#​809) (8f7c678), closes #​809
• Support async operation handler resolver (#​921) (a4a7175), closes #​921
• upgrade ajv (a708132)
• upgrade example 3 (43cccc8)
• upgrade example 4 (255f20f)
• v5.2.0 (42cb3ab)
• chore: apiSpec may be const literal (#​854) (e35a07c), closes #​854
• chore(dependencies): bump @​apidevtools/json-schema-ref-parser to 11.6.2 to prevent vulnerability (#​9 (61ff0cf), closes #​918
• chore(deps-dev): bump @​babel/traverse (#​924) (5a04ea9), closes #​924
• chore(deps): bump axios, @​nestjs/common, @​nestjs/core, @​nestjs/platform-express and @​nestjs/testing (b77150f), closes #​925
• chore(deps): bump webpack and @​nestjs/cli in /examples/9-nestjs (#​831) (c0c5f4c), closes #​831
• fix: examples/4-eov-operations-babel/package.json & examples/4-eov-operations-babel/package-lock.jso (87d173b), closes #​911
• fix: package.json & package-lock.json to reduce vulnerabilities (#​920) (898ceb7), closes #​920
• fix: upgrade @​types/multer from 1.4.7 to 1.4.11 (#​897) (a7d67e7), closes #​897
• fix: upgrade path-to-regexp from 6.2.0 to 6.2.2 (#​914) (bce2d6a), closes #​914

5.1.6 (2024-02-11)

• Fixes for 881 - multiple specs w/validateRequests fail (#​903) (766806b), closes #​903

5.1.5 (2024-02-10)

• fixes write-only tests (8c53e58)
• Support writeOnly + required combination #​149 (#​756) (4f16ed2), closes #​149 #​756
• v5.1.5 (708f2f5)

5.1.4 (2024-02-09)

• add cookies to examples 1 and 2 (#​891) (2c95d5b), closes #​891
• Direct example broken link to the guide (00a9c8f)
• fixes badging for build and test (631fb7b)
• npm audit fix (#​892) (2977c0a), closes #​892
• Remove read only and write only fields (#​895) (97617fd), closes #​895 #​627
• removes lodash.uniq and lodash.zipobject dependencies (#​893) (1206802), closes #​893
• Update CONTRIBUTING.md (6d67169)
• Update README.md (dffda28)
• Update README.md (bdd0d79)
• Update README.md (#​896) (bb66916), closes #​896
• v5.1.4 (b3d7483)
• v5.1.4 (509fa22)
• fix: #​887 allow multiple params with wildcard (#​898) (2d33d0a), closes #​887 #​898 #​1
• docs: fix doc typo in README.md (#​885) (8a81bf8), closes #​885

5.1.3 (2024-01-27)

• CLS Context is lost after using multer middleware (#​695) (40716fb), closes #​695
• remove examples from schema (#​890) (0ad49ec), closes #​890
• v5.1.3 (f806690)
• v5.1.3 (e567701)

5.1.2 (2023-12-04)

• Normalize request body ContentTypes (#​863) (0099b0d), closes #​863
• Safer handling of multipart nested JSON body props (#​878) (807e09c), closes #​878
• v5.1.1 (4b0c989)

5.1.1 (2023-11-21)

• Pass-through HttpError caught in multipart handler (#​867) (240c876), closes #​867
• v5.1.0 (a9a3b0b)
• v5.1.1 (a4e62ac)

5.1.0 (2023-11-12)

• Allow optional use of req.url (#​857) (f732379), closes #​857
• Reorder upload and security middlewares (#​866) (95543d6), closes #​866 #​865
• Update build and packaging scripts (#​872) (dd4027f), closes #​872
• update version locks (bb8d6b8)
• v5.1.0 (839f859)

5.0.5 (2023-08-23)

• #​841 return error thrown in serDes deserializer (#​842) (d029401), closes #​841 #​842
• fix documentation links (01950b7)
• fix example schema removal and upgrade patch version (495dabd)
• fixing default export function issue (#​846) (268d38a), closes #​846
• Remove body-parser deps in example (#​845) (c73b7c1), closes #​845
• Remove examples from apiDoc when validating requests (#​774) (950d429), closes #​774
• Resolve "reference resolves to more than one schema" errors when AJV processes OpenAPI document and (9d215be), closes #​853
• v5.0.5 change history (b5cc33a)

5.0.4 (2023-04-30)

• Switch json-schema-ref-parser to non-deprecated package (#​829) (f5bbce9), closes #​829
• v5.0.4 (9b89c79)
• fix: Deserialize custom types with inline schemas (#​823) (d53621d), closes #​823

5.0.3 (2023-03-04)

• FIx serialization/deserialization in additionalProperties (#​822) (a9067b8), closes #​822
• Rename field error_code to errorCode in ValidationErrorItem (#​819) (1a1b2cc), closes #​819
• v5.0.3 (6e93a96)
• chore(deps): bump cookiejar from 2.1.2 to 2.1.4 in /examples/9-nestjs (#​805) (07d9879), closes #​805
• chore(deps): bump cookiejar from 2.1.3 to 2.1.4 (#​806) (0da34f8), closes #​806
• chore(deps): bump http-cache-semantics (#​811) (7a779f6), closes #​811
• chore(deps): bump http-cache-semantics (#​813) (336683d), closes #​813
• chore(

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cypress]

overseerr    Run #2886

Run Properties:   Passed #2886  •  48486332c1: fix(deps): update dependency express-openapi-validator to v5

Project	overseerr
Branch Review	refs/pull/3209/merge
Run status	Passed #2886
Run duration	02m 21s
Commit	48486332c1: fix(deps): update dependency express-openapi-validator to v5
Committer	renovate[bot]
View all properties for this run ↗︎

---

Test results
Failures	0
Flaky	0
Pending	0
Skipped	0
Passing	28
View all changes introduced in this branch ↗︎