[ericproulx]

Summary

OneofValidator gives each variant its own copy of the value, so a variant that fails after coercing or defaulting something doesn't leak that into the next one. It made the copy with deep_dup, which also copies the leaves, and that breaks uploads:

params do
  requires :value, type: Hash, oneof: [proc { requires :upload, type: File }]
end

Every valid upload gets a 400, value does not match any of the allowed schemas, and has since oneof was added in 3.3.0. The same param in a plain Hash scope works.

Tempfile is a delegator and doesn't inherit from Object, so Object#deep_dup is forwarded to the File it wraps and returns a bare File. Types::File.parsed? then fails its is_a?(Tempfile) check.

Validators write by assigning into Hashes and Arrays, so this PR copies only those and shares the leaves.

Isolation between variants

No spec pinned this: the full suite passed with no copy at all. The new specs show what each kind of copy does when the first variant fails and the second wins:

Request	deep_dup (before)	dup	no copy	this PR
Nested code: "007", coerced to Integer by the failed variant	"007"	"7"	"7"	"007"
The same inside an Array element	"007"	"7"	"7"	"007"
Nested default set by the failed variant	nil	"red"	"red"	nil
File upload in a variant	400	201	201	201

One limit: a custom coercer that mutates a String in place, rather than returning a new value, would now be seen by later variants, because leaves are shared.

Dropped require

This was Grape's last call to deep_dup, so active_support/core_ext/object/deep_dup is no longer required by lib/grape.rb. An app outside Rails that calls deep_dup while relying on Grape to have loaded it now needs its own require. That was never documented, so there is no UPGRADING entry. grape-swagger and grape-entity don't use it.

Test plan

• bundle exec rake passes: RuboCop clean, 3162 examples, 0 failures.
• oneof_validator_spec.rb passes on gemfiles/rack_2_2.gemfile and gemfiles/rack_3_2.gemfile.
• Mutation-checked: going back to deep_dup, a shallow dup, no copy, not copying Arrays, and copying Hashes one level only each fail at least one new spec.
• CI green.

🤖 Generated with Claude Code

[github-actions]

Danger Report

No issues found.

View run