v1.18.1

Security

• A schema can no longer give itself or an embedded schema a file: $id unless it was loaded from the filesystem. Before this fix, a schema retrieved from the web could use a file: $id to make its $refs resolve against a file: base and load local schema files. A file: id is now allowed only when the URI it resolves against is also a file: URI.

Fixes

• multipleOf gives correct results for very small divisors and very large values. Values much smaller than the divisor, like 1e-20 with multipleOf: 1, no longer pass. (#140, by @MohitSAGAR11)
• A schema that fails meta-validation is rejected every time it's validated. Before, only the first validation failed, and later validations used the invalid schema as if it had passed. (#134, by @MohitSAGAR11)
• Fixed the type of SchemaParameter.schema in the openapi-3-1 types: it was OasSchema32 and is now OasSchema31. (#137, by @tarunagnihotri534)

JSON Schema v1 dialect

• The format keyword respects shouldValidateFormat. It still validates formats by default, but now you can turn that off.
• The date-time format validates against RFC 9557, which allows time zone and suffix tags such as 2026-11-14T12:00:00-08:00[America/Los_Angeles]. The v1 handler uses the https://json-schema.org/format/date-time URI. The RFC 3339 handler that draft-04 through draft-2020-12 use moved to https://json-schema.org/format/draft-04/date-time.
• $dynamicRef no longer accepts a leading #. Write "$dynamicRef": "foo", not "$dynamicRef": "#foo".

Performance

• Schema registry lookups take constant time whether or not you pass a browser. Browsers look up registered schemas in the registry instead of copying the registry into their own cache. As a result, browsers always see the current registry, and a schema you unregister is no longer found by browsers that already exist. (#131, by @Kaileshwar16)
• An instance node now computes its URI only once. This speeds up output formats and plugins that record instance locations. Validating a 150KB GitHub workflow with BASIC output went from about 3.8ms to 3.0ms.

Internal

• The test runners support the unified JSON Schema test suite and filter format tests by their format-assertion and format-annotation tags.
• Adopted @stylistic/eslint-plugin 6.0.0.

Full Changelog: v1.18.0...v1.18.1