18.0.3

• change: @apidevtools/swagger-parser: optionalDependencies → devDependencies
• change: @apidevtools/json-schema-ref-parser: ^15.3.5 → ^15.5.0
• change: @hapi/inert: ^7.1.0 → ^7.1.2
• change: joi (dev): ^18.1.2 → ^18.2.3
• change: pnpm.overrides (@hapi/content, @hapi/wreck, brace-expansion, fast-uri, flatted, js-yaml)

18.0.1

• use object spread syntax to prevent prototype pollution
• don't allow JS strings, opens XSS opportunties

18.0.0

The major focus of this release was joi 18 and transforming this into a more svelte, secure, and maintainable module with a dramatically smaller install, no unmaintained dependencies, and a greatly reduced attack surface.

• drop support for node < 22
• test: initialize vs port listeners, so tests exit properly
• shrank dependencies from 535 to 141
• test runner: @hapi/lab -> node:test
• hapi-auth-jwt2 + jsonwebtoken → @hapi/basic
• lint-staged removed — .husky/pre-commit now runs pnpm lint directly
• tsd → tsc --noEmit — tsconfig.json created targeting index.d.ts + index.test-d.ts
• @types/node added (needed by @hapi/hapi's own types)
• eslint 7 → 10
• delete: @babel/core + @babel/eslint-parser
• swagger-parser reclassified to optionalDependencies
• hapi-auth-bearer-token → hapi-auth-jwt2
• @hapi/wreck → node:stream/consumers
• @hapi/boom — removed (replaced with h.response().code(401))
• delete: @hapi/code, @hapi/eslint-plugin
• @hapi/hoek removed — all 64 usages replaced with native JS (optional chaining, spread, isDeepStrictEqual, Array#filter/includes)
• @apidevtools/json-schema-ref-parser demoted to optionalDependencies with lazy-require
• swagger-ui-dist lazy-loaded — only required inside the documentationPage/swaggerUI gate
• swagger-parser bug fixed — was a devDep used at runtime; now lazy-required
• is-ci removed — replaced with inline process.env.CI check
• fixes hapi-swagger#1072

v17.4.0

Full Changelog: https://github.com/msimerson/hapi-openapi/commits/v17.4.0