Comparing changes

## Fixes Or Enhances Resolves #1550 The `uUIDRegexString` regex only matched lowercase hex digits (a-f), causing valid UUIDs containing uppercase letters (e.g., `2830923A-E5F5-4178-9700-787586673E0D`) to fail validation. UUIDs are case-insensitive per RFC 4122, so both cases should be accepted. - Updated `uUIDRegexString` to accept both uppercase and lowercase hex characters (a-fA-F), aligning it with the behaviour of `uUIDRFC4122RegexString`. - Added a test to cover UUID validation with uppercase hex digits. - Manually tested against the example in the issue and the expected behaviour is now observed. **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

## Fixes Or Enhances Addresses issue #1552 **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

Add strict BCP47 language tag validator enforcing RFC5646 and rejecting Unicode extensions unlike language.Parse(). ## Fixes Or Enhances Fix #1221. **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

Bumps [golang.org/x/text](https://github.com/golang/text) from 0.35.0 to 0.36.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/8577a70117e110160c45f32af0e0df84eef844f7"><code>8577a70</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.35.0...v0.36.0">compare view</a></li> </ul> </details> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.35.0&new-version=0.36.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.49.0 to 0.50.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/crypto/commit/03ca0dcccbd37ba6be80adf74dde8d78a4d72817"><code>03ca0dc</code></a> go.mod: update golang.org/x dependencies</li> <li><a href="https://github.com/golang/crypto/commit/8400f4a938077a7a7817ab7d163d148e371b320b"><code>8400f4a</code></a> ssh: respect signer's algorithm preference in pickSignatureAlgorithm</li> <li><a href="https://github.com/golang/crypto/commit/81c6cb34a8fc386ed53293cd79e3c0c232ee7366"><code>81c6cb3</code></a> ssh: swap cbcMinPaddingSize to cbcMinPacketSize to get encLength</li> <li>See full diff in <a href="https://github.com/golang/crypto/compare/v0.49.0...v0.50.0">compare view</a></li> </ul> </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

Based on discussion in [1496](#1496) a experimental change to allow reducing the build sizes. This adds a build tag `validator_novalidatefn` that makes any usage of `validateFn` panic. The idea is that we can eliminate calls to `tryCallValidateFn` that in turn uses `field.MethodByName` that can't be dead code eliminated. Added a small block for docs, but I am not the best doc writer, so some feedback would be welcome there. Maybe something more is needed?

…dded standalone isMIMEType validator for flexibility (#1544) ## Summary Adds a new built-in `mimetype` validator for file paths. It supports both exact MIME matches and wildcard subtype matches: ```go validate.Var("photo.png", "mimetype=image/png") validate.Var("photo.png", "mimetype=image/*") ``` ## Changes - add `mimetype` as a built-in validation tag - extract shared file MIME detection logic - refactor `isImage` to reuse the shared MIME detection helper - keep `isImage`'s existing explicit image MIME allowlist unchanged - add docs and tests for `mimetype` - add default translations and translation tests for `mimetype` ## Notes `mimetype` accepts: - `type/subtype` - `type/*` Validation fails if the field is not a string, the file does not exist, the path is a directory, the MIME type cannot be detected, or the validator param is invalid. **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

This PR adds missing translations for the `timezone` validation tag in both **English (en)** and **Japanese (ja)** locales. Previously, the `timezone` tag did not have a localized error message in these languages, causing it to fallback to the default tag name. This enhancement ensures a better user experience for developers using these locales. ## Changes - Added `timezone` translation to `translations/en/en.go` - Added `timezone` translation to `translations/ja/ja.go` - Added unit tests for `timezone` translation in `translations/en/en_test.go` - Added unit tests for `timezone` translation in `translations/ja/ja_test.go` **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

## Fixes Or Enhances Closes #743 Replace the `err.(validator.ValidationErrors)` type assertion in the README and `_examples/translations/main.go` with `errors.As`, matching the pattern already used in `_examples/simple/main.go` and `_examples/struct-level/main.go`. `go-errorlint` flags the type-assertion form. **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

## Fixes Or Enhances Added `origin` tag for web origin URLs. **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers --------- Signed-off-by: Ahmed Kamal <[email protected]>

## Fixes Or Enhances Similar to the recent fix #1565 6bcb7bc RFC 952 is now fixed to reject hostname labels with trailing hyphen **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers Signed-off-by: Ahmed Kamal <[email protected]>

…guard (#1574) ## Fixes Or Enhances - Move `inline` from `linters.disable` to `settings.govet.disable` to properly suppress Go 1.24+ false positives regarding `reflect.Ptr` constant inlining - Disable deprecated `gomodguard` linter to resolve golangci-lint v2 warnings Related to: https://github.com/go-playground/validator/actions/runs/25698487406/job/75452753081 ``` run golangci-lint Running [/home/runner/golangci-lint-2.12.2-linux-amd64/golangci-lint config path] in [/home/runner/work/validator/validator] ... Running [/home/runner/golangci-lint-2.12.2-linux-amd64/golangci-lint config verify] in [/home/runner/work/validator/validator] ... Running [/home/runner/golangci-lint-2.12.2-linux-amd64/golangci-lint run] in [/home/runner/work/validator/validator] ... Error: baked_in.go:390:23: inline: Constant reflect.Ptr should be inlined (govet) if elem.Kind() == reflect.Ptr { ^ Error: baked_in.go:409:22: inline: Constant reflect.Ptr should be inlined (govet) if elem.Kind() == reflect.Ptr { ^ Error: baked_in.go:431:20: inline: Constant reflect.Ptr should be inlined (govet) if sf.Kind() == reflect.Ptr { ^ 3 issues: * govet: 3 level=warning msg="The linter 'gomodguard' is deprecated (since v2.12.0) due to: new major version. Replaced by gomodguard_v2." level=warning msg="Suggested new configuration:\nlinters:\n enable:\n - gomodguard_v2\n" Error: issues found Ran golangci-lint in 19996ms ``` **Make sure that you've checked the boxes below before you submit PR:** - [ ] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

Bumps [golang.org/x/text](https://github.com/golang/text) from 0.36.0 to 0.37.0. <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/golang/text/commit/3ef517e623a4bfc08d6457f87d73afda7af7d8e1"><code>3ef517e</code></a> go.mod: update golang.org/x dependencies</li> <li>See full diff in <a href="https://github.com/golang/text/compare/v0.36.0...v0.37.0">compare view</a></li> </ul> </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

@daily

The cron validator's regex lacked `^...$` anchors, so any string containing a cron-like substring (e.g. `"random text @daily more text"`, `"prefix @every 1h suffix"`, `"x 1 2 3 4 5 y"`) was accepted as a valid cron expression. Anchoring alone wasn't sufficient — the original field pattern only recognized plain numeric forms and was getting away with it via substring matching. Several existing positive test cases (`?`, `L`, `MON-FRI`, `#`, multi-field expressions with year) only passed because the regex matched a numeric fragment of the input. The field pattern is now expanded to accept the documented cron alphabet (`*`, `?`, digits, letters, `,`, `/`, `-`, `#`, `L`, `W`) while still rejecting bare single letters like "x" that aren't valid in any cron dialect. Negative test cases added to lock in the new behavior, with a note documenting remaining false positives that would require a real cron parser to reject (out-of-range values, nonsense alphabetic tokens, etc). - Fixes #1576 ## Fixes Or Enhances **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers Signed-off-by: Ahmed Kamal <[email protected]>

@deankarn

## Fixes Or Enhances When `RegisterTagNameFunc` returns `""` (typically for `json:"-"` or equivalent), the field currently falls back to the struct field name in error namespaces, defeating the tag-name remapping. This PR adds the WithTagNameFuncBlankOmit option that preserves the blank and omits the field from the error namespace - nested struct levels collapse, and leaf field namespaces trim the trailing separator. Gated behind an option for v10 backward compatibility. According to @deankarn this was always meant to be the behaviour (see #1426 (comment)) so I've gone off the assumption this will be the default in v11 and followed the example of `WithRequiredStructEnabled`. **Make sure that you've checked the boxes below before you submit PR:** - [x] Tests exist or have been written that cover this particular change. @go-playground/validator-maintainers

## Summary The README.md validation table in the Format section has a typo: the RIPEMD-160 hash entry incorrectly lists the tag as `ripemd128` instead of `ripemd160`. **Before:** ``` | ripemd128 | RIPEMD-128 hash | | ripemd128 | RIPEMD-160 hash | ``` **After:** ``` | ripemd128 | RIPEMD-128 hash | | ripemd160 | RIPEMD-160 hash | ``` The actual tag in [`baked_in.go`](https://github.com/go-playground/validator/blob/master/baked_in.go) and [`regexes.go`](https://github.com/go-playground/validator/blob/master/regexes.go) is `ripemd160`, so the README was simply missing the correct tag name. ## Verification - Checked `baked_in.go` line 188: `"ripemd160": isRIPEMD160` - Checked `regexes.go` line 48: `ripemd160RegexString = "^[0-9a-f]{40}$"` - Checked `validator_test.go`: both `ripemd128` and `ripemd160` tags are tested independently Co-authored-by: Sediman <[email protected]>

Navigation Menu

Uh oh!

Comparing changes

Open a pull request

Commits on Apr 6, 2026

Commits on Apr 9, 2026

Commits on Apr 13, 2026

Commits on Apr 19, 2026

Commits on Apr 20, 2026

Commits on Apr 23, 2026

Commits on Apr 27, 2026

Commits on Apr 29, 2026

Commits on May 18, 2026

Commits on May 25, 2026

Commits on May 26, 2026

Commits on May 29, 2026

This comparison is taking too long to generate.

Uh oh!