npm / orval
orval
What changed in orval 8, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.
5 breaking12 security5 new APIs and options5 behavior and defaults16 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initorval 843 changes
Breaking changes 5
Keys remain required when the parent or an allOf member requires them.
A false property renders as S.Never after dereference.
The generated server is migrated to MCP TypeScript SDK v2.
Self-referencing schemas are no longer aliased in single schemas mode.
Effect output drops non-primitive enum members and serializes values via toJsLiteral.
Security 12
Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref
Orval: Import-time RCE via array-items default -> zod module-level template literal
Orval: Import-time RCE via enum-typed default -> zod module-level template literal
Orval: Import-time RCE via header-parameter default -> zod module-level template literal
Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client
Orval: Import-time RCE via query-parameter default -> zod module-level template literal
Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli
Orval: Import-time RCE via schema default -> zod module-level template literal
Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client
Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout)
Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator
Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification)
New APIs and options 5
Adds opt-in typed fixtures for mocks.
Adds an Angular option to emit body-only signatures.
Adds an injection mode for fetch client factories.
Adds opt-in operation manifest output.
Adds override.mcp.cacheHints.
Behavior and default changes 5
Mutator paths now resolve through tsconfig paths aliases.
Per-operation response mocks are written in tags-operations modes.
The specification description is emitted as McpServer instructions.
Missing response descriptions now receive a default instead of causing validation to fail.
Mock generators can be used with TypeScript single-file schemas.
Fixes and other changes 16
Zod now honors additionalProperties on objects that also have properties.
Objects with properties remain open to additionalProperties.
The generated McpServer version now uses the specification's info.version.
Null property values pass through dereference.
Duplicate nullable component aliases are avoided.
The params object is now always passed to a custom client footer.
Recursive external schemas are added as components instead of being cut off.
Bodies and responses with reusable schemas resolve one level.
Resolves __REF_ sentinels in split-mode schema output.
Zod output applies a scalar parent type to an allOf member that does not have one.
Zod output keeps allOf-$ref object defaults with tuples inline.
Generated code qualifies Blob and File with globalThis when a component shadows them.
Zod output skips length, bound and pattern checks on a const.
Effect 4 output merges nullable and open allOf members.
Effect output renders a false schema as S.Never and makes it optional when it is not required.
Effect output skips length and pattern checks on a string const.