Update dependency swagger-typescript-api to ^13.12.4

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
swagger-typescript-api	^13.0.22 → ^13.12.4
swagger-typescript-api	^13.0.23 → ^13.12.4

---

Release Notes

acacode/swagger-typescript-api (swagger-typescript-api)

v13.12.4

Compare Source

Patch Changes

• 5a327e9 Thanks @​js2me! - Security: Potential SSRF via URL input in Request.download()

• #​1803 7bd2b17 Thanks @​morgan-coded! - Handle object-shaped not schemas without crashing

v13.12.3

Compare Source

Patch Changes

• 77a5bbc Thanks @​js2me! - update deps to latest

v13.12.2

Compare Source

Patch Changes

• #​1779 306d59a Thanks @​js2me! - Fix code injection via unescaped enum string values in generated TypeScript enums

  Malicious OpenAPI specs could embed arbitrary JavaScript in components.schemas.*.enum string values. Ts.StringValue wrapped values in double quotes without escaping, allowing attackers to break out of generated enum declarations and inject code that executes at module load when consumers import the generated client. Enum string values are now properly escaped.

  Reported by @​thegr1ffyn: GHSA-5f94-x226-ccpm.

• #​1779 306d59a Thanks @​js2me! - Fix code injection via unescaped servers[0].url in generated axios and fetch HTTP clients

  Malicious OpenAPI specs could embed arbitrary JavaScript in servers[0].url. The value was interpolated raw into string literals in generated client constructors, allowing computed-property-key injection and arbitrary code execution when consumers instantiated HttpClient or Api (axios) or imported the generated module (fetch). apiConfig.baseUrl is now escaped once at the source before template rendering.

  Reported by @​thegr1ffyn: GHSA-38c3-wv3c-v3xj (axios), GHSA-hqj5-cw9f-rx67 (fetch).

• #​1779 306d59a Thanks @​js2me! - Fix code injection via unescaped OpenAPI path strings in generated method bodies

  Malicious OpenAPI specs could embed arbitrary JavaScript in path keys. Values were interpolated raw into template literals in generated API methods, so ${…} expressions ran with full process privileges on every call to the affected method. Route paths are now escaped for template-literal insertion while preserving deliberate ${paramName} interpolations for declared path parameters.

  Reported by @​thegr1ffyn: GHSA-w284-33mx-6g9v.

• #​1779 306d59a Thanks @​js2me! - Fix authorization-token exfiltration and SSRF via spec $ref during remote schema resolution

  When generating from a remote OpenAPI spec, the generator walked every external $ref and fetched any http(s):// URL without validating the target. A malicious spec could force HTTP requests to loopback, RFC-1918, link-local (including cloud metadata at 169.254.169.254), or internal hostnames reachable from the generator process. Redirect chains were also followed without re-validation.

  Remote schema fetches now enforce a defense-in-depth policy:

  • Block private, link-local, and loopback addresses (IPv4 and IPv6), including localhost
  • Allow cross-origin fetches only to public hosts; same-origin $ref targets remain allowed
  • Allow the explicit --url spec source even on loopback (local development)
  • Follow redirects manually (max 5) and re-validate each hop
  • Forward authorizationToken only to same-origin remote URLs, not cross-origin $ref targets

  Reported by @​thegr1ffyn: GHSA-h754-fxp7-88wx, GHSA-x36r-4347-pm5x.

v13.12.1

Compare Source

Patch Changes

• caa2874 Thanks @​js2me! - update all deps to latest (patch + minor deps, no major updates)

v13.12.0

Compare Source

Minor Changes

• 691559a Thanks @​js2me! - Add enumStyle: "const-enum" to generate TypeScript const enum declarations for schema enums and the built-in ContentType.

v13.11.2

Compare Source

Patch Changes

• 691d07d Thanks @​js2me! - Fix schema type name resolution when preferExistingSchemaNamesForExternalRefs is false

  When preferExistingSchemaNamesForExternalRefs is disabled, schema components with external refs were not re-parsed with the correct type name formatter, leading to incorrect type names in generated output. Now the formatter is precommitted with existing component names and affected schemas are re-parsed.

v13.11.1

Compare Source

Patch Changes

• bfad977 Thanks @​js2me! - fixed preferExistingSchemaNamesForExternalRefs parameter

v13.11.0

Compare Source

Minor Changes

• f5cb2da Thanks @​js2me! - Fix external file $ref resolution and add cleaner schema naming for split OpenAPI specs.

Bug fixes

• Resolve external schema file refs (e.g. ./SidecarConfig.yaml, ./models/sidecar-config.yaml) without producing ghost types such as SidecarConfigYaml that were referenced in generated output but never exported.
• Treat path segments like models, definitions, and . as schema components instead of misclassifying them as OpenAPI component sections.
• Normalize type names derived from external filenames by stripping .yaml, .yml, and .json extensions.
• Unwrap file-only refs to external documents that contain a single entry under components.schemas.
• Deduplicate externally resolved components that share the same disambiguated type name, preventing repeated export interface declarations (e.g. multiple NovaEntityNovaEntity) and TypeScript merge conflicts.
• Recognize OpenAPI 3.1 pathItems as a valid components section when resolving JSON pointer segments.

New option

• Add preferExistingSchemaNamesForExternalRefs (CLI: --prefer-existing-schema-names-for-external-refs).
  When enabled, if an external schema file name matches an existing local component name (e.g. ./Specification.yaml → Specification), the generator reuses the local schema name instead of emitting redundant names like SpecificationSpecification or NovaEntityNovaEntity.
  Local $ref-only components are eagerly resolved before parsing.

Tests

• Add paths-2 regression tests for remote OpenAPI specs with relative cross-file refs (CICD Spec Manager fixture).
• Add paths-2-prefer-existing-schema-names tests for the new naming option, including strict TypeScript checks of generated snapshot output via tsc.

Patch Changes

• #​1762 6d00192 Thanks @​Upgrade220! - Fix ContentType in http-client not respecting enumStyle: "union". It now generates a plain type alias instead of an enum, and all call sites emit string literals instead of ContentType.Json etc.

v13.10.0

Compare Source

Minor Changes

• #​1754 9d493e8 Thanks @​Upgrade220! - Add enumStyle option ("enum" | "union" | "const") to control enum output format. "const" generates as const objects with a companion type alias, including the built-in ContentType in the http-client. generateUnionEnums is deprecated in favor of enumStyle: "union".

Patch Changes

• #​1756 fed24c6 Thanks @​Upgrade220! - Fix: combined query params object now correctly gets a default value of {} when all its fields are optional and no path params are present (extractRequestParams mode)

v13.9.3

Compare Source

Patch Changes

• ef8114d Thanks @​js2me! - correct processing parse swagger 2.0 schema as async task

v13.9.2

Compare Source

Patch Changes

• 81d8dab Thanks @​js2me! - better typings for swaggerSchema, originalSchema and resolvedSwaggerSchema

v13.9.1

Compare Source

Patch Changes

• #​1466 e109c9a Thanks @​k1rd3rf! - Add possibility to change default request params

  Useful when overriding the http client, and you want to make sure the request params are set.

  Can be set to "" in order to not make it optional.

v13.9.0

Compare Source

Minor Changes

• 58c6818 Thanks @​js2me! - local fragment ref partial support (#..)

v13.8.0

Compare Source

Minor Changes

• 1a1f5b6 Thanks @​js2me! - support gitlab repository files external refs

• 74d16fb Thanks @​js2me! - support github repository files external refs

v13.7.2

Compare Source

Patch Changes

• 5f6b28a Thanks @​js2me! - yet another fix of the issue #​1433 (incorrect yaml multiline parsing)

v13.7.1

Compare Source

Patch Changes

• 189ad98 Thanks @​js2me! - fixed normalization external refs in swagger schema

v13.7.0

Compare Source

Minor Changes

• beccbaa Thanks @​js2me! - Add typeNameSeparator config option for joining typePrefix, type name,
  and typeSuffix in TypeNameFormatter.

  This separator is primarily effective with disableFormatTypeNames: true,
  or when custom hooks.onFormatTypeName preserves separators without
  normalization.

• 162739a Thanks @​js2me! - Add disableFormatTypeNames option to disable type name formatting
  and normalization in the generator.

  When enabled, generated names keep raw separators (for example,
  Foo_Bar stays Foo_Bar), which prevents collisions caused by
  startCase-based normalization (such as Foo_Bar and FooBar
  both becoming FooBar).

  The option is available in config and via CLI as
  --disable-format-type-names, and is covered by a dedicated
  spec test in tests/spec/disableFormatTypeNames.

Patch Changes

• #​1726 1b60264 Thanks @​mlewando-cp! - Dedupe colliding TypeScript identifiers produced by the TypeNameFormatter.

  Two OpenAPI schema keys that differ only in separator placement — e.g.
  Foo_Bar and FooBar — used to collapse to the same identifier via
  startCase + whitespace-strip and emit two export interface FooBar
  declarations (TS2717 whenever the shapes differed).

  TypeNameFormatter now exposes a precommit(rawNames) method the generator
  calls once after loading schema components and before schema parsing. It
  resolves every raw name in two passes — canonical names (raw === formatted
  output) claim their slot first, then non-canonical names suffix-until-free —
  so user-declared identifiers like FooBar1 are preserved regardless of
  source order, and collisions deterministically produce FooBar, FooBar1,
  FooBar2, … References to each schema (including inline generics in route
  handlers) stay consistent with the emitted export interface declarations.

  format() is now a pure cache lookup with a fallback for names discovered
  after precommit (enum keys, extractEnums/extractResponses results). All
  formatting logic is concentrated in a single private computeFormattedName
  helper, so the new behavior composes cleanly with disableFormatTypeNames
  and typeNameSeparator.

  Fixes #​1724.

v13.6.11

Compare Source

Patch Changes

• #​1722 586d60b Thanks @​tenenger7125! - Add: null to allOf intersection types with nullable(true)

v13.6.10

Compare Source

Patch Changes

• 08026ef Thanks @​js2me! - add servers field to route info raw

v13.6.9

Compare Source

Patch Changes

• 756f5aa Thanks @​js2me! - rich typings and data for parsed route raw data

v13.6.8

Compare Source

Patch Changes

• 8414b3c Thanks @​js2me! - Fix extracted response/error type names colliding with existing schemas. Add tests.

v13.6.7

Compare Source

Patch Changes

• 4603a7e Thanks @​js2me! - fixed bug #​1668 (random of type names)

v13.6.6

Compare Source

Patch Changes

• d57ecdc Thanks @​js2me! - fix bug #​1433 (incorrect yaml multiline files)

v13.6.5

Compare Source

Patch Changes

• bd68761 Thanks @​js2me! - fixed bug linked with unused query param (bug #​1433 , 1 point)

v13.6.4

Compare Source

Patch Changes

• df7147e Thanks @​js2me! - fixed bug #​1433 (multiline descriptions bug)

v13.6.3

Compare Source

Patch Changes

• 41bdc18 Thanks @​js2me! - fixed convertation format: json\blob for responses with extractResponseBody flag

• 41bdc18 Thanks @​js2me! - fix contentTypes internal field for route

v13.6.2

Compare Source

Patch Changes

• 1f1ba56 Thanks @​js2me! - add internal pass data for binary checks responses

v13.6.1

Compare Source

Patch Changes

• #​1722 586d60b Thanks @​tenenger7125! - Add: null to allOf intersection types with nullable(true)

v13.6.0

Compare Source

Minor Changes

• c4b02db Thanks @​js2me! - paths with "produces" with binary mime types only should return only binary type - Blob

v13.5.0

Compare Source

Minor Changes

• 1ed598b Thanks @​js2me! - add missing string->byte convertaion (Blob)

v13.4.0

Compare Source

Minor Changes

• f2f27aa Thanks @​js2me! - support contentMediaType property

• #​1643 7f76066 Thanks @​nolannbiron! - Wrap Record types in Partial for propertyNames

v13.3.1

Compare Source

Patch Changes

• 96f5b8d Thanks @​js2me! - fixes #​551 issue (@​type property in interfaces)

• f032ff1 Thanks @​js2me! - fixed #​893 issue

• 639c3ae Thanks @​js2me! - fixed #​1536 issue

v13.3.0

Compare Source

Minor Changes

• #​1434 6d977dd Thanks @​js2me! - partial support external paths by ref (#​447)

• #​1434 6d977dd Thanks @​js2me! - added partial support links property (jsdoc ref only)

v13.2.18

Compare Source

Patch Changes

• #​1620 def2833 Thanks @​smorimoto! - Restore objectAssign utility with es-toolkit to fix codeGenConstructs and primitiveTypeConstructs options. The lodash-to-es-toolkit migration (#​1562) replaced objectAssign with Object.assign, which broke function-form arguments and deep merging. This restores both behaviors: functions are called with the current struct before merging, and nested properties are preserved via deep merge.

• #​1611 92a2d46 Thanks @​smorimoto! - Escape */ sequences in generated JSDoc content to prevent comment injection from OpenAPI fields.

v13.2.17

Compare Source

Patch Changes

• #​1603 19a4d29 Thanks @​clicktodev! - Fix missing closing angle bracket in describeReturnType function's default case, which produced malformed return type syntax Promise<HttpResponse<T, E> instead of Promise<HttpResponse<T, E>>.

• #​1606 0528831 Thanks @​smorimoto! - Replace Yarn with Bun as the package manager.

v13.2.16

Compare Source

Patch Changes

• #​1459 6b485dd Thanks @​smorimoto! - Downgrade eta from 4.0.1 to 3.5.0 to fix module resolution error.

  After the upgrade to eta@​4.0.1 in version 13.2.11, API generation started
  failing with ERR_PACKAGE_PATH_NOT_EXPORTED: No "exports" main defined in eta/package.json. This issue is caused by incorrect package export
  configuration in eta@​4.0.1, which is tracked in the upstream repository.

  Downgrading to eta@​3.5.0 resolves the module resolution error whilst
  maintaining compatibility with the existing template system.

  Fixes #​1427.

v13.2.15

Compare Source

Patch Changes

• afc2448 Thanks @​js2me! - added ability to override usageSchema and originalSchema after onInit hook and before all other operations

v13.2.14

Compare Source

Patch Changes

• #​1398 d987aee Thanks @​k1rd3rf! - Fix modular template to always generate class property syntax.

  The modular template was incorrectly using object method syntax (: and
  ,) when route.namespace was present, introduced by PR #​1326. This
  caused TypeScript syntax errors in generated code.

  The modular template should always generate class properties with arrow
  functions (= and ;), regardless of namespace presence.

  This resolves the issue reported in #​1366 where version 13.2.8 generated
  invalid TypeScript code with modular templates.

v13.2.13

Compare Source

Patch Changes

• #​1424 aa79764 Thanks @​smorimoto! - Ensure discriminator mappings use union enum literals.

  Resolve discriminator mapping generation to use literal values when
  generateUnionEnums is enabled to avoid emitting enum member references.
  Add regression coverage that snapshots the discriminator output with
  union enums.

• #​1422 724b0cd Thanks @​smorimoto! - Replace js-yaml with yaml.

  Switch YAML parsing from js-yaml to yaml. Update the resolver to
  use YAML.parse when JSON.parse fails. Remove js-yaml and its types,
  add yaml as a runtime dependency. No public API changes.

v13.2.12

Compare Source

Patch Changes

• #​1420 426433b Thanks @​smorimoto! - Move @types/lodash and openapi-types to dependencies.

  These type packages are referenced by the published declarations, so consumers
  require them at install time for correct type resolution. Moving them from
  devDependencies prevents downstream TypeScript errors whilst having no
  runtime impact.

v13.2.11

Compare Source

Patch Changes

• #​1390 5897e4b Thanks @​MatanAvneri! - Fix being able to call getComponentByRef from templates.

• #​1393 9a7c788 Thanks @​RoCat! - Ensure discriminators are just after enums in components list to avoid cyclic errors.

• #​1416 cd127a9 Thanks @​smorimoto! - Fix fetch client response parsing without re-reading body.

v13.2.10

Compare Source

Patch Changes

• 7b7351f Thanks @​js2me! - Fix missing exported interfaces and types.

v13.2.9

Compare Source

Patch Changes

• #​1384 0caea2c Thanks @​smorimoto! - Fix enum const parsing for substrings of primitive types.

• #​1381 ba052f4 Thanks @​smorimoto! - Support extracting request parameters for routes that only declare path parameters, such as DELETE methods.

• #​1382 792e96c Thanks @​smorimoto! - Fix enum string value quoting when schema type mismatches.

• #​1385 859fc64 Thanks @​smorimoto! - Avoid response cloning in fetch HTTP client to prevent memory leaks (#​779).

• #​1383 8191970 Thanks @​smorimoto! - Automatically extract enums when using enum names as values.

• #​1376 bec35e8 Thanks @​smorimoto! - Merge GenerateApiParamsBase into GenerateApiConfiguration to remove duplicated type definitions and expose missing configuration fields. Document configuration defaults with JSDoc tags.

• #​1378 912e521 Thanks @​smorimoto! - Allow partial extractingOptions in generateApi configuration.

• #​1380 fec0a09 Thanks @​smorimoto! - Add test verifying primitive + object anyOf unions.

• #​1376 bec35e8 Thanks @​smorimoto! - Restore modular option typing in generateApi parameters.

• #​1379 339a167 Thanks @​smorimoto! - Support synchronous require in templates using Node's createRequire.

v13.2.8

Compare Source

Patch Changes

• #​1326 99b5f50 Thanks @​thejhh! - Fix TypeScript generation failure for operationIds starting with numbers

  What: Fixed an issue where operationIds starting with numbers (e.g., "123getUser") would cause TypeScript generation to fail due to invalid identifier names.

  Why: OperationIds that start with numbers are not valid JavaScript identifiers, causing syntax errors in the generated TypeScript code.

  How: Modified the template logic to quote property names for invalid identifiers. OperationIds starting with numbers are now generated as quoted properties (e.g., "123GetUser": ...) instead of unquoted invalid identifiers.

  This resolves GitHub issue #​952.

• #​1008 c2d3e6a Thanks @​frazar! - Fix handling of FormData inputs in Fetch HTTP client

  Previously, when users passed a FormData object directly to the Fetch
  client's multipart/form-data formatter, it would incorrectly attempt to use
  Object.keys() on the FormData instance, which returns an empty array. This
  caused the FormData to be processed incorrectly.

  The fix adds a type check to return FormData instances unchanged, allowing
  users to have full control over FormData construction when needed whilst
  maintaining backwards compatibility for object inputs. This aligns the Fetch
  client behaviour with the existing Axios client implementation.

  This resolves issues where users needed to send multipart requests with
  multiple entries for the same key, which is only possible with direct FormData
  manipulation.

v13.2.7

Compare Source

Patch Changes

• #​1308 36fc899 Thanks @​js2me! - add missing required state for query param with $ref

v13.2.6

Compare Source

Patch Changes

• #​1306 fe125cb Thanks @​js2me! - better extracting description for request body extacting types

v13.2.5

Compare Source

Patch Changes

• #​1302 790fece Thanks @​js2me! - added support x-propertyNames, propertyNames for object types

v13.2.4

Compare Source

Patch Changes

• #​1299 9552c0a Thanks @​js2me! - added support of x-enum-descriptions property

v13.2.3

Compare Source

Patch Changes

• #​1293 a87883b Thanks @​smorimoto! - Bump Biome to 2.0.

v13.2.2

Compare Source

Patch Changes

• #​1287 87da340 Thanks @​smorimoto! - Pin versions of internal Biome packages.

v13.2.1

Compare Source

Patch Changes

• #​1620 def2833 Thanks @​smorimoto! - Restore objectAssign utility with es-toolkit to fix codeGenConstructs and primitiveTypeConstructs options. The lodash-to-es-toolkit migration (#​1562) replaced objectAssign with Object.assign, which broke function-form arguments and deep merging. This restores both behaviors: functions are called with the current struct before merging, and nested properties are preserved via deep merge.

• #​1611 92a2d46 Thanks @​smorimoto! - Escape */ sequences in generated JSDoc content to prevent comment injection from OpenAPI fields.

v13.2.0

Compare Source

Minor Changes

• #​1187 1039ff1 Thanks @​gletournel! - Add support for json:api content type.

Patch Changes

• #​1225 a013686 Thanks @​smorimoto! - Update the internal Biome to latest beta release.

• #​1266 469ded7 Thanks @​dependabot! - Update the internal Biome to latest beta release.

• #​1235 0e251bb Thanks @​smorimoto! - Fix typos in CLI option description and warning message.

• #​1270 c79625e Thanks @​smorimoto! - Remove required field from command definitions for now.

v13.1.3

Compare Source

Patch Changes

• #​1200 3cc0194 Thanks @​smorimoto! - Search swagger-typescript-api.config instead of config by default.

v13.1.2

Compare Source

Patch Changes

• #​1198 1cb1c9c Thanks @​smorimoto! - Integrate generateCommand arguments and run method into main command.

v13.1.1

Compare Source

Patch Changes

• #​1163 e477b58 Thanks @​RoXuS! - Ensure enums are at the top of the components to avoid issue on recursive schema parsing.

v13.1.0

Compare Source

Minor Changes

• #​1144 ea1df18 Thanks @​smorimoto! - Use c12 for wider configuration file format support.

Patch Changes

• #​1171 c1cc45a Thanks @​smorimoto! - Fix TypeScript declaration file path.

• #​1149 9d2d66a Thanks @​smorimoto! - Re-add TypeScript definitions for better type support.

• #​1145 73f6bfd Thanks @​smorimoto! - Replace Prettier with Biome as the code formatter to improve performance during the code generation phase.

• #​1141 821bfad Thanks @​dding-g! - Remove redundant union-enums option in favor of generate-union-enums.

v13.0.28

Compare Source

Patch Changes

• 6851bdc Thanks @​smorimoto! - Fix description for client option in generateCommand.

• #​1121 5eadf67 Thanks @​takayukioda! - Fix to not use no- prefix in options.

• edca5de Thanks @​smorimoto! - Fix option name for generateUnionEnums in generateCommand.

• 9fa8f41 Thanks @​smorimoto! - Sort the CLI arguments alphabetically.

v13.0.27

Compare Source

Patch Changes

• #​1119 [c5e8d45](https://redirect.github.c

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.