[dinwwwh]

Docs only. Widens the kin-openapi openapi3filter bullet from #389 in packages/downgrader/README.md from query and path values to every parameter location and to request bodies.

kin-openapi v0.153.0 openapi3filter.ValidateRequest, run on a 3.1 doc and its downgraded 3.0 output:

where	schema in 3.1	3.0 output	value	3.1	3.0
header X-Pr, cookie cpr	anyOf [$ref Prio (number enum), null]	oneOf [$ref, null branch]	5	OK	REJECT
header X-Nb, cookie cnb	anyOf [number, boolean, null]	oneOf [number, boolean, null branch]	true, 5	OK	REJECT
form-urlencoded field	anyOf [$ref Prio, null]	oneOf [$ref, null branch]	pr=5	OK	REJECT
form-urlencoded field	anyOf [number, boolean, null]	oneOf [number, boolean, null branch]	nb=5, nb=true	OK	REJECT
form-urlencoded field	anyOf [$ref I (integer), null]	oneOf [$ref, null branch]	ir=5	OK	REJECT
multipart text part	type: [string, integer]	oneOf [string, integer]	any	OK	REJECT ("Value is not nullable")

• Headers, cookies and form-encoded fields (decodeSchemaConstructs -> decodeProperty) all go through the same decodeValue as query and path values, so the last-branch decoding from docs(downgrader): kin-openapi's request validation decodes a parameter with the null branch's string type #389 applies to them too.
• MultipartBodyDecoder calls parsePrimitive on each text part, and parsePrimitive only loops over schema.Type. With no type it returns nil, so any union part decodes as null.
  • A 3.1 anyOf union is rejected there as well, so it behaves the same in both versions.
  • A 3.1 type list is read correctly, but it becomes a oneOf with no type in 3.0, so every value is rejected.
  • Null-branch oneOfs accept any value, since null matches the null branch, so they only loosen.

The other diffs in that run come from kin's 3.1 leniency, such as anyOf [integer, null] accepting oi=true. Those are not values the input accepts.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VVaw7RH2JEkf9zKoSXLUbC

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 27 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 4a7aeabd-c967-4f3d-b23e-d799b13ae00e

Commits

Reviewing files that changed from the base of the PR and between 8b8fadd and 27c55ac.

Files selected for processing: 1

• packages/downgrader/README.md

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@openapi-spec/downgrader@391

npm i https://pkg.pr.new/@openapi-spec/router@391

npm i https://pkg.pr.new/@openapi-spec/types@391

commit: 27c55ac

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[codspeed]

Merging this PR will not alter performance

✅ 31 untouched benchmarks
⏩ 2 skipped benchmarks¹

---

_{Comparing claude/project-thread-a8h0xv (27c55ac) with main (8b8fadd)}

Footnotes

1. 2 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

[pullfrog]

ℹ️ No critical issues — one wording precision note inline.

Reviewed changes

• kin-openapi body coverage: extends the openapi3filter limitation bullet in packages/downgrader/README.md to form-encoded fields and multipart/form-data text parts, documenting that a 3.1 multi-type part becomes a typeless oneOf in 3.0 whose text part decodes as null. Verified against kin-openapi v0.153.0 source (UrlencodedBodyDecoder → decodeSchemaConstructs → decodeProperty → decodeValue; MultipartBodyDecoder → parsePrimitive) and the 3.1→3.0 convertType/scalarOneOf path.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No new issues in the latest commit — the earlier wording note on the multipart sentence still stands.

Reviewed changes

• Header and cookie parameters: widens the kin-openapi bullet's parameter locations from "query or path" to "query, path, header or cookie". Verified in kin-openapi v0.153.0 req_resp_decoder.go: decodeStyledParameter selects headerParamDecoder/cookieParamDecoder and routes both through the same decodeValue, so the documented last-branch oneOf behavior applies as written.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Your OpenRouter API key was rejected. Issue a new key with the provider, then update the copy Pullfrog uses, in Pullfrog or in this repo's GitHub Actions secrets.

The provider's response

provider error: User not found.

Pullfrog provider settings → · GitHub Actions secrets →

  ^{｜ Rerun failed job ➔ ｜ View workflow run ｜ via Pullfrog ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS)}

[pullfrog]

✅ No new issues found.

Reviewed changes

• Multipart type-list qualifier: narrows the multipart claim to a type list without "null", and notes that a list containing "null" downgrades to a oneOf whose null branch accepts the null that parsePrimitive returns. Verified against convertType/singleType/scalarOneOf: two or more non-null types become the typeless oneOf, a single-type list collapses to a plain type, and the nullable list adds onlyNull(), which matches the decoded nil.

  ^{｜ View workflow run ｜ Using deepseek-v4.1-flash-1017 (free via Pullfrog for OSS) ｜ 𝕏}