feat: support echo v5 by jinuthankachan · Pull Request #48 · oapi-codegen/echo-middleware

jinuthankachan · 2026-04-14T05:15:49Z

closes #37

socket-security · 2026-04-14T05:16:10Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/labstack/echo/v5@v5.1.0
	github.com/getkin/kin-openapi@v0.135.0
	github.com/stretchr/testify@v1.11.1

View full report

mromaszewicz · 2026-04-14T17:52:15Z

@jamietanna - what do you think, should we put echo V5 as a sub-module of echo-middleware or make a repo specifically for it?

The middleware itself, for V4 and V5 is basically identical.

I would love to see both just call through to shared code, but Go's module system makes it annoying since each sub-module requires its own git tag for each release to keep various tools happy, like Renovate.

mromaszewicz · 2026-04-14T17:49:32Z

@@ -0,0 +1,27 @@
+module github.com/oapi-codegen/echo-middleware/v5
+
+go 1.26.2


Echo works fine with Go 1.25.0 (https://github.com/labstack/echo/blob/v5/go.mod), so I think we should try not to get ahead of it too much to allow as many users as possible to use this package. Lots of people can't update to the latest Go version immediately due to all kinds of internal company bureaucracy.

jinuthankachan#1 should resolve this

jamietanna

I think child Go module is ok but not like this right now - if we do, it'll cause Go module versioning confusion, and can make it seem like it's v5 of this module - I'd say maybe echov5

I agree that a separate repo may not be ideal given the shared code

Also, if we are doing a submodule, this will require we change our release process (which is fine, but calling it out)

All **8 tests pass** cleanly with Go 1.25.0: | Test | Result | |------|--------| | `TestOapiRequestValidator` | ✅ PASS | | `TestOapiRequestValidatorWithOptionsMultiError` | ✅ PASS | | `TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler` | ✅ PASS | | `TestOapiRequestValidatorWithPrefix` | ✅ PASS | | `TestEncodedPathParams` | ✅ PASS | | `TestGetSkipperFromOptions` | ✅ PASS | | `ExampleOapiRequestValidatorWithOptions` | ✅ PASS | | `ExampleOapiRequestValidatorWithOptions_withErrorHandler` | ✅ PASS |

…ode redundancy

jinuthankachan · 2026-04-15T08:26:36Z

@mromaszewicz @jamietanna

I have tried to apply some of your suggestion in the above commits.
After applying the above changes,

Shared validation logic eliminates some code duplication.
Existing users unaffected. (echo/v4)
New echov5 users have clear import path (github.com/oapi-codegen/echo-middleware/echov5).
Maintaining releases would be tricky though due to the base module dependency. I've got no clear solution for this.
Test Results

=== ROOT MODULE (Echo v4) ===
=== RUN   TestOapiRequestValidator
2026/04/15 13:31:57 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidator (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiError
2026/04/15 13:31:57 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiError (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler
2026/04/15 13:31:57 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler (0.01s)
=== RUN   TestOapiRequestValidatorWithPrefix
--- PASS: TestOapiRequestValidatorWithPrefix (0.00s)
=== RUN   TestEncodedPathParams
--- PASS: TestEncodedPathParams (0.01s)
=== RUN   TestGetSkipperFromOptions
--- PASS: TestGetSkipperFromOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions
--- PASS: ExampleOapiRequestValidatorWithOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions_withErrorHandler
--- PASS: ExampleOapiRequestValidatorWithOptions_withErrorHandler (0.00s)
PASS
coverage: 75.3% of statements
ok  	github.com/oapi-codegen/echo-middleware	0.068s	coverage: 75.3% of statements
	github.com/oapi-codegen/echo-middleware/internal/validation		coverage: 0.0% of statements

=== ECHOV5 SUBMODULE (Echo v5) ===
=== RUN   TestOapiRequestValidator
2026/04/15 13:32:00 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidator (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiError
2026/04/15 13:32:00 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiError (0.01s)
=== RUN   TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler
2026/04/15 13:32:01 WARN: OapiRequestValidatorWithOptions called with an OpenAPI spec that has `Servers` set. This may lead to an HTTP 400 with `no matching operation was found` when sending a valid request, as the validator performs `Host` header validation. If you're expecting `Host` header validation, you can silence this warning by setting `Options.SilenceServersWarning = true`. See https://github.com/oapi-codegen/oapi-codegen/issues/882 for more information.
--- PASS: TestOapiRequestValidatorWithOptionsMultiErrorAndCustomHandler (0.00s)
=== RUN   TestOapiRequestValidatorWithPrefix
--- PASS: TestOapiRequestValidatorWithPrefix (0.00s)
=== RUN   TestEncodedPathParams
--- PASS: TestEncodedPathParams (0.01s)
=== RUN   TestGetSkipperFromOptions
--- PASS: TestGetSkipperFromOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions
--- PASS: ExampleOapiRequestValidatorWithOptions (0.00s)
=== RUN   ExampleOapiRequestValidatorWithOptions_withErrorHandler
--- PASS: ExampleOapiRequestValidatorWithOptions_withErrorHandler (0.00s)
PASS
coverage: 75.3% of statements
ok  	github.com/oapi-codegen/echo-middleware/echov5	0.054s	coverage: 75.3% of statements

The project structure

echo-middleware/
├── go.mod                           # Main module (Echo v4)
├── go.sum
├── oapi_validate.go                 # Echo v4 implementation
├── oapi_validate_test.go            # Echo v4 tests
├── oapi_validate_example_test.go    # Echo v4 examples
├── internal/
│   └── validation/
│       └── validate.go              # Shared validation logic
├── echov5/
│   ├── go.mod                       # Submodule (Echo v5)
│   ├── go.sum
│   ├── oapi_validate.go             # Echo v5 wrapper
│   ├── oapi_validate_test.go        # Echo v5 tests
│   ├── oapi_validate_example_test.go# Echo v5 examples
│   └── test_spec.yaml
└── test_spec.yaml

jinuthankachan · 2026-04-15T16:10:50Z

In case we could tolerate some code redundancy, I could modify the PR with relevant changes .
It might help us not getting into the intra-repo module dependency issue.

matdibu · 2026-04-28T15:47:34Z

+const (
+	EchoContextKey = "oapi-codegen/echo-context"
+	UserDataKey    = "oapi-codegen/user-data"
+)


these two are the same as the ones in internal/validation/validate.go

could/should you use those directly?

matdibu · 2026-04-28T15:49:59Z

+	}
+
+	// Build validation context with Echo context and user data
+	requestContext := context.WithValue(context.Background(), validation.EchoContextKey, c) //nolint:staticcheck


is context.Background() correct here, or should it be c.Request().Context() ?

matdibu · 2026-04-28T15:51:33Z

+				var coder interface{ StatusCode() int }
+				if errors.As(err, &coder) {
+					return echo.NewHTTPError(coder.StatusCode(), err.Error())
+				}


should there be a fallback for errors that don't happen to be either echo.HTTPError or coder?

* oapi-codegen#48 (comment) * oapi-codegen#48 (comment) * oapi-codegen#48 (comment)

feat: support echo v5

d616095

jinuthankachan requested a review from a team as a code owner April 14, 2026 05:15

jinuthankachan mentioned this pull request Apr 14, 2026

Support echo/v5 #37

Open

mromaszewicz reviewed Apr 14, 2026

View reviewed changes

jamietanna requested changes Apr 14, 2026

View reviewed changes

jinuthankachan mentioned this pull request Apr 15, 2026

chore: the v5 submodule dependency downgrade to go 1.25.0 jinuthankachan/echo-middleware#1

Merged

jinuthankachan added 2 commits April 15, 2026 13:27

refactor: restructure the project to have shared code pkg to reduce c…

bc62855

…ode redundancy

refactor: modify test cmd in make file

193e762

jinuthankachan closed this Apr 15, 2026

jinuthankachan deleted the v5 branch April 15, 2026 08:07

jinuthankachan reopened this Apr 15, 2026

jinuthankachan requested review from jamietanna and mromaszewicz April 15, 2026 08:28

matdibu reviewed Apr 28, 2026

View reviewed changes

chore: apply review suggestions

340ef86

* oapi-codegen#48 (comment) * oapi-codegen#48 (comment) * oapi-codegen#48 (comment)

jinuthankachan requested a review from matdibu April 30, 2026 06:43

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: support echo v5#48

feat: support echo v5#48
jinuthankachan wants to merge 5 commits intooapi-codegen:mainfrom
jinuthankachan:v5

jinuthankachan commented Apr 14, 2026

Uh oh!

socket-security Bot commented Apr 14, 2026 •

edited

Loading

Uh oh!

mromaszewicz commented Apr 14, 2026

Uh oh!

mromaszewicz Apr 14, 2026

Uh oh!

jinuthankachan Apr 15, 2026

Uh oh!

jamietanna left a comment

Uh oh!

jinuthankachan commented Apr 15, 2026 •

edited

Loading

Uh oh!

jinuthankachan commented Apr 15, 2026 •

edited

Loading

Uh oh!

matdibu Apr 28, 2026

Uh oh!

matdibu Apr 28, 2026

Uh oh!

matdibu Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

		@@ -0,0 +1,27 @@
		module github.com/oapi-codegen/echo-middleware/v5

		go 1.26.2

Uh oh!

Conversation

jinuthankachan commented Apr 14, 2026

Uh oh!

socket-security Bot commented Apr 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

mromaszewicz commented Apr 14, 2026

Uh oh!

mromaszewicz Apr 14, 2026

Choose a reason for hiding this comment

Uh oh!

jinuthankachan Apr 15, 2026

Choose a reason for hiding this comment

Uh oh!

jamietanna left a comment

Choose a reason for hiding this comment

Uh oh!

jinuthankachan commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jinuthankachan commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

matdibu Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

matdibu Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

matdibu Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

socket-security Bot commented Apr 14, 2026 •

edited

Loading

jinuthankachan commented Apr 15, 2026 •

edited

Loading

jinuthankachan commented Apr 15, 2026 •

edited

Loading