Merge the openapi_parameters gem into openapi_first - #496
Merged
Conversation
ahx
force-pushed
the
merge-openapi-parameters
branch
from
August 12, 2026 13:26
424a4ac to
4966f28
Compare
Request#parameters returns the parameters defined for a request as Parameters::Parameter objects, ordered path, query, header, cookie, and excluding the header parameters openapi_first ignores. Parameter is public API now and answers required? and deprecated? again, which describing a parameter needs. This replaces the reader that was removed when openapi_parameters was merged in, which handed out Builder's private_constant bundle of raw parameter hashes and JSON schemas. Deliberately not delegated from ValidatedRequest: that would shadow ActionDispatch::Request#parameters for Rails users. Co-Authored-By: Claude
Malformed parameter values escaped as exceptions out of validate_request instead of failing validation, all reachable from untrusted input: - Repeated values for a query parameter that describes an object or uses content (?filter=a&filter=b) reached String#split or JSON.parse with an Array. These now throw :skip, so the raw values fall through to schema validation, like the other values these unpackers cannot unpack. - A style: matrix value that does not contain the parameter name, or contains it more than once, reached nil.split or Array#split. These are now left to the converter, which is what the same values already did with explode: true, so both spellings agree. - An invalid %-encoding in a matrix or path object value made Rack::Utils.parse_query raise, and the value now falls through to schema validation. Rack 2.2 and 3.0 raise a plain ArgumentError here, Rack 3.2 an InvalidParameterError, which is one. Every value that could be unpacked before is unpacked to exactly the same thing. The behaviour was inherited from openapi_parameters 0.13.0. Co-Authored-By: Claude
ahx
force-pushed
the
merge-openapi-parameters
branch
from
August 12, 2026 13:37
4966f28 to
334d3f2
Compare
ahx
marked this pull request as ready for review
August 12, 2026 13:37
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vendors the
openapi_parametersgem into this repo asOpenapiFirst::Parametersand drops the runtime dependency, so parameter parsing can evolve together with the rest of openapi_first.Along the way:
Request#parametersis now a public API returningParameters::Parameterobjects (name,location,schema,required?,deprecated?,style,explode?,media_type).contentquery parameter, malformedmatrixvalues, broken%-encoding) now return a validation failure instead of raisingNoMethodError/TypeError/ArgumentError.Breaking changes and fixes are listed under
## UnreleasedinCHANGELOG.md.🤖 Generated with Claude Code