build(deps): bump github.com/danielgtaylor/huma/v2 from 2.39.0 to 2.39.1

[dependabot]

Bumps github.com/danielgtaylor/huma/v2 from 2.39.0 to 2.39.1.

Release notes

Sourced from github.com/danielgtaylor/huma/v2's releases.

v2.39.1

Overview

A patch release: correctness fixes for resolvers, validation, and response handling, plus a dependency refresh.

Response Status Visible to Middleware Again

WithContext context propagation in v2.39.0 copied the response status by value, so middleware that called WithContext and then read Status() after next() always saw 0 instead of the status the handler set, breaking access logging and telemetry. The status is now shared by every context copy across all adapters, restoring the pre-2.39 invariant while keeping context propagation intact. (#1081)

Resolvers & Defaults in Arrays and Maps

• Nested resolvers now run for fixed-size arrays ([2]Item), not just slices (#1076)
• A resolver on a named collection type (e.g. type Coords [2]float64) no longer panics, and is no longer conflated with a resolver on its element type, which previously ran the element's resolver twice and the collection's never (#1082)
• Values reached through a map are now written back after being walked, so applying a default no longer panics with reflect: reflect.Value.Set using unaddressable value and resolver mutations are no longer silently discarded (#1082)

Stricter email and uri Formats

Validation for two string formats is tighter, so payloads that previously passed may now return 422:

• email / idn-email accept an addr-spec only; full mailbox forms with a display name (Name <user@example.com>) are rejected
• uri / iri require an absolute URI with a non-empty scheme, while relative references remain valid under uri-reference / iri-reference (#1068)

Validation Robustness

• An unresolvable schema $ref during Validate now reports expected schema $ref to resolve: ... instead of panicking on a nil dereference, covering discriminators and map[string]any / map[any]any values (#1065)
• Named numeric slice parameters (e.g. type IDs []int64) are built with their declared element type and validated with item, length, and uniqueness constraints intact (#1074)

Other Fixes

• Resolver errors that wrap a HeadersError now contribute their headers to the response, matching the handler error path (#1070)
• A nil interface response body no longer panics in the schema link transformer (#1072)
• Dependencies updated (#1066)

What's Changed

• fix: do not panic on unresolved schema $ref during Validate by @​baiyuxi930826 in danielgtaylor/huma#1065
• chore: update dependencies by @​wolveix in danielgtaylor/huma#1066
• fix: tighten format email and uri validation by @​baiyuxi930826 in danielgtaylor/huma#1068
• fix: preserve wrapped resolver error metadata by @​ggmolly in danielgtaylor/huma#1070
• fix: handle nil interface response bodies by @​ggmolly in danielgtaylor/huma#1072
• fix: parse named numeric slice parameters by @​ggmolly in danielgtaylor/huma#1074
• fix: share response status across WithContext copies by @​wolveix in danielgtaylor/huma#1081
• fix: run nested resolvers in fixed arrays by @​ggmolly in danielgtaylor/huma#1076
• fix: distinguish collection and element matches when walking input by @​wolveix in danielgtaylor/huma#1082

New Contributors

• @​baiyuxi930826 made their first contribution in danielgtaylor/huma#1065
• @​ggmolly made their first contribution in danielgtaylor/huma#1070

Full Changelog: danielgtaylor/huma@v2.39.0...v2.39.1

Commits

• 198225e fix: distinguish collection and element matches when walking input (#1082)
• 5961f0a fix: run nested resolvers in fixed arrays (#1076)
• 85aad8f fix: share response status across WithContext copies (#1081)
• 22a3cb0 fix: parse named numeric slice parameters (#1074)
• ac9959c fix: handle nil interface response bodies (#1072)
• b659c74 fix: preserve wrapped resolver error metadata (#1070)
• 14aea2f fix: tighten format email and uri validation (#1068)
• bba0d54 chore: update dependencies (#1066)
• e114668 fix: do not panic on unresolved schema $ref during Validate (#1065)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)