# What changed in orval

> 43 changes in orval 8 from its official release notes, upgrade guides and advisories: 5 breaking, 12 security, 5 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/orval/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## orval 8

### Breaking changes

- Keys remain required when the parent or an allOf member requires them. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- A false property renders as S.Never after dereference. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- The generated server is migrated to MCP TypeScript SDK v2. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Self-referencing schemas are no longer aliased in single schemas mode. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Effect output drops non-primitive enum members and serializes values via toJsLiteral. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)

### Security

- Orval: Generation-time SSRF + remote/local file inclusion via unrestricted $ref (8.22.0) — [security advisory](https://github.com/advisories/GHSA-CXQ5-97V7-87J8)
- Orval: Import-time RCE via array-items default -> zod module-level template literal (8.21.0) — [security advisory](https://github.com/advisories/GHSA-2H9G-J24R-H63G)
- Orval: Import-time RCE via enum-typed default -> zod module-level template literal (8.21.0) — [security advisory](https://github.com/advisories/GHSA-3575-W9FC-C2J6)
- Orval: Import-time RCE via header-parameter default -> zod module-level template literal (8.21.0) — [security advisory](https://github.com/advisories/GHSA-8J6P-R8JG-MXQH)
- Orval: Import-time RCE via header parameter name -> computed-property-key injection in the zod client (8.21.0) — [security advisory](https://github.com/advisories/GHSA-6437-GXHQ-PQV8)
- Orval: Import-time RCE via query-parameter default -> zod module-level template literal (8.21.0) — [security advisory](https://github.com/advisories/GHSA-P4CG-3328-RVFG)
- Orval: Import-time RCE via query parameter name -> computed-property-key injection in the zod cli (8.21.0) — [security advisory](https://github.com/advisories/GHSA-653Q-5476-X79G)
- Orval: Import-time RCE via schema default -> zod module-level template literal (8.21.0) — [security advisory](https://github.com/advisories/GHSA-W727-8J6C-2RJ4)
- Orval: Import-time RCE via schema property name -> computed-property-key injection in the zod client (8.21.0) — [security advisory](https://github.com/advisories/GHSA-6MR6-JVCR-2F25)
- Orval: RCE via OpenAPI path -> unescaped request-URL template literal (backtick breakout) (8.21.0) — [security advisory](https://github.com/advisories/GHSA-FG9P-MRXR-HVQ7)
- Orval: RCE via schema property name -> computed-property-key injection in the MSW mock generator (8.21.0) — [security advisory](https://github.com/advisories/GHSA-2W86-XFRC-G85R)
- Orval: RCE via servers[].url -> unescaped request-URL template literal (with getBaseUrlFromSpecification) (8.21.0) — [security advisory](https://github.com/advisories/GHSA-88F2-FPV8-89Q2)

### New APIs and options

- Adds opt-in typed fixtures for mocks. (8.43.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.43.0)
- Adds an Angular option to emit body-only signatures. (8.43.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.43.0)
- Adds an injection mode for fetch client factories. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Adds opt-in operation manifest output. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Adds override.mcp.cacheHints. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)

### Behavior and default changes

- Mutator paths now resolve through tsconfig paths aliases. (8.43.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.43.0)
- Per-operation response mocks are written in tags-operations modes. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- The specification description is emitted as McpServer instructions. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Missing response descriptions now receive a default instead of causing validation to fail. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Mock generators can be used with TypeScript single-file schemas. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)

### Fixes and other changes

- Zod now honors additionalProperties on objects that also have properties. (8.43.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.43.0)
- Objects with properties remain open to additionalProperties. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- The generated McpServer version now uses the specification's info.version. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Null property values pass through dereference. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Duplicate nullable component aliases are avoided. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- The params object is now always passed to a custom client footer. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Recursive external schemas are added as components instead of being cut off. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Bodies and responses with reusable schemas resolve one level. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Resolves __REF_ sentinels in split-mode schema output. (8.42.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.42.0)
- Zod output applies a scalar parent type to an allOf member that does not have one. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)
- Zod output keeps allOf-$ref object defaults with tuples inline. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)
- Generated code qualifies Blob and File with globalThis when a component shadows them. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)
- Zod output skips length, bound and pattern checks on a const. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)
- Effect 4 output merges nullable and open allOf members. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)
- Effect output renders a false schema as S.Never and makes it optional when it is not required. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)
- Effect output skips length and pattern checks on a string const. (8.41.0) — [release notes](https://github.com/orval-labs/orval/releases/tag/v8.41.0)