openapi_parser 2.5.0 → 2.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e570c33d05a24e9b11a3f5b86f5321f895088a672d404df68f3d14b4d3f9fb8f
-  data.tar.gz: fadcedd0e7b7c5ce057f2b0fa36f313218f151ae524dd2290c1242fbdfca02da
+  metadata.gz: 265685ba8a1e648f9b4611356022227b5d80917f46d2450dae55747ffec40a23
+  data.tar.gz: 9ba7d7d561d7ec84a5ce6a8c42cb13beffa09e1250699b206f6e4ec639350575
 SHA512:
-  metadata.gz: 680325ae11c7dce38425d23c89918d3ce5cb768261dbd48f6d21c166ca0d89b2dbf9304297b2f754830f47cdf8d45dd2501371b396fe972957474e171f4b3b49
-  data.tar.gz: 27b757f70c102671ff1f2891918f5e7abb044796e280027b097214f4f0bbb2ff538b7f7c84d7d1bb7f1fc8b46b63591ad62e37985dab50ebb35c0603b854e92e
+  metadata.gz: 4168f6e1dcedcd2c8be552937692215f8214511df0979f7bcc3d4ec00181980e5d397bc5cb0288cf9fc498eafc3a1322f0f1579bad89fb4915221b6b62a4f667
+  data.tar.gz: 6fe2b4ae0877312fcdd0f6fc56643c7658e9e6325cffaa066caec1b263e6657c88db5a7233d6bd24ce7d8270ff8d5e1d7d8c7b38188e4ac237ca86cb5f374a4c

data/.github/workflows/ci.yaml

@@ -11,13 +11,11 @@ jobs:
           - ubuntu-latest
           - macos-latest
         ruby:
-          - "2.7"
-          - "3.0"
-          - "3.1"
           - "3.2"
           - "3.3"
           - "3.4"
           - "4.0"
+          - "4.1"
           - ruby-head
     runs-on: ${{ matrix.os }}
     steps:

data/CHANGELOG.md

@@ -1,5 +1,39 @@
 ## Unreleased
 
+## 2.6.0 (2026-11-04)
+* support the `multipleOf` keyword (OpenAPI 3.0 and 3.1): a number that is not a multiple of it now fails with `NotMultipleOf`. Decimals are compared exactly, so `19.99` is a multiple of `0.01`. A `multipleOf` that is not a positive number is still ignored. It was ignored before, so a value that passed may now fail
+* support the `not` keyword (OpenAPI 3.0 and 3.1): a value that is valid against the `not` schema now fails with `NotSchemaMatched`. It was ignored before, so a value that passed may now fail
+* add OpenAPI 3.2 `SpecValidator` rules
+  * `CookieStyleBefore32`: detect Parameter `style: cookie` usage in pre-3.2 documents (3.2 addition)
+  * `DefaultMappingBefore32`: detect Discriminator `defaultMapping` usage in pre-3.2 documents (3.2 addition)
+  * `MediaTypesBefore32`: detect `components.mediaTypes` usage in pre-3.2 documents (3.2 addition)
+  * `XmlNodeTypeBefore32`: detect XML Object `nodeType` usage in pre-3.2 documents (3.2 addition)
+  * `XmlAttributeDeprecation` / `XmlWrappedDeprecation`: detect XML Object `attribute: true` / `wrapped: true` in 3.2 documents (deprecated in 3.2 in favor of `nodeType`)
+  * `QueryMethodBefore32`: detect Path Item `query` usage in pre-3.2 documents (3.2 addition)
+  * `AdditionalOperationsBefore32`: detect Path Item `additionalOperations` usage in pre-3.2 documents (3.2 addition)
+  * `ResponseSummaryBefore32`: detect Response Object `summary` usage in pre-3.2 documents (3.2 addition)
+  * `TagFieldsBefore32`: detect Tag Object `summary` / `parent` / `kind` usage in pre-3.2 documents (3.2 additions)
+  * `ServerNameBefore32`: detect Server Object `name` usage in pre-3.2 documents (3.2 addition)
+  * `AllowEmptyValueDeprecation`: detect Parameter `allowEmptyValue` usage in 3.2 documents (deprecated in 3.2)
+  * `ExampleValueFieldsBefore32`: detect Example Object `dataValue` / `serializedValue` usage in pre-3.2 documents (3.2 additions)
+  * `SecuritySchemeFieldsBefore32`: detect Security Scheme `deprecated` / `oauth2MetadataUrl` and the `deviceAuthorization` OAuth flow in pre-3.2 documents (3.2 additions)
+  * `StreamingFieldsBefore32`: detect Media Type `itemSchema` / `itemEncoding` / `prefixEncoding` and nested Encoding Object `encoding` / `itemEncoding` / `prefixEncoding` usage in pre-3.2 documents (3.2 additions)
+  * `QuerystringBefore32`: detect Parameter `in: querystring` usage in pre-3.2 documents (3.2 addition; not validated at runtime)
+* return nil from `request_operation` for a document without `paths` (3.1 allows a document with only `webhooks`), instead of raising `NoMethodError`
+* support `$defs` (OpenAPI 3.1) in Schema Objects so `$ref`s into it, such as `#/components/schemas/Pet/$defs/Id`, resolve
+* add `SpecValidator` rule `DefsIn30`: detect `$defs` in 3.0 documents (3.1 addition)
+* validate a value against a schema without `type`: keywords such as `properties`, `required`, `items`, `maxLength`, `enum` and `minimum` now apply when the value has the type the keyword is for, as in JSON Schema. They were all skipped before, so a value that breaks them may now fail validation
+* support Discriminator `defaultMapping` (OpenAPI 3.2): fallback schema when the discriminator property is absent or its value has no explicit or implicit mapping; honored in 3.2 documents
+* add `allow_3_2_features` config to apply OpenAPI 3.2 runtime behavior to documents that declare an earlier version (default `false`: pre-3.2 documents behave as before)
+* accept `null` for a schema without `type`, as in JSON Schema. `enum` still applies, so `null` must be listed there when `enum` is set. A schema without `type` used to reject `null` with `NotNullError`, so a value that failed before may now pass
+* accept a Float with no fractional part, such as `1.0`, for `type: integer` in OpenAPI 3.1 documents, as in JSON Schema. OpenAPI 3.0 defines an integer as a number without a fraction, so 3.0 documents still reject it. In 3.1 documents a value that failed before may now pass, and `oneOf` with both `integer` and `number` now rejects `1.0` because it matches both
+* support `components.mediaTypes` (OpenAPI 3.2), resolving `$ref`s in request body and response `content` in 3.2 documents; an unresolved one accepts any body unless `strict_reference_validation` is set
+* support the `query` HTTP method and `additionalOperations` (OpenAPI 3.2) on Path Items, including request-operation lookup, in 3.2 documents
+* match HTTP methods case-insensitively in request-operation lookup in 3.2 documents (`request_operation("GET", path)` still returns nil before 3.2)
+* support Response Object `summary` (OpenAPI 3.2) in the parse layer
+* accept a file object for array-form `type` with `format: binary` (3.1) when `coerce_value` is off, the same way as a single `type: string`
+* support `itemSchema` (OpenAPI 3.2) in the parse layer; it is not yet used to validate sequential media type bodies
+
 ## 2.5.0 (2026-10-21)
 * add OpenAPI 3.2 `SpecValidator` rules
   * `SelfBefore32`: detect `$self` usage in pre-3.2 documents (3.2 addition)

data/README.md

@@ -4,7 +4,7 @@
 [![Yard Docs](https://img.shields.io/badge/yard-docs-blue.svg)](https://www.rubydoc.info/gems/openapi_parser)
 [![Inch CI](https://inch-ci.org/github/ota42y/openapi_parser.svg?branch=master)](https://inch-ci.org/github/ota42y/openapi_parser)
 
-This is OpenAPI3 parser and validator.
+This is OpenAPI3 parser and validator (OpenAPI 3.0, 3.1 and 3.2).
 
 ## Usage
 
@@ -89,6 +89,49 @@ options = {
 OpenAPIParser.parse(yaml_file, options)
 ```
 
+### Supported OpenAPI versions
+
+The parser accepts OpenAPI 3.0, 3.1, and 3.2 documents. Parsing and runtime request/response validation are version-permissive: supported keywords are honored regardless of the document's declared `openapi:` version (for example, both `nullable` and `type: [..., "null"]` work everywhere).
+
+The exception is 3.2 behavior that would change how an existing 3.0 or 3.1 document validates. It applies only to documents that declare 3.2 or later:
+
+- `$ref`s in request body and response `content` (e.g. into `components.mediaTypes`)
+- the `query` operation, `additionalOperations`, and case-insensitive method matching in `request_operation`
+- Discriminator `defaultMapping`
+
+A file loaded through a `$ref` that declares no `openapi:` version follows the document that loaded it. To opt earlier documents in, pass `allow_3_2_features: true`:
+
+```ruby
+OpenAPIParser.parse(schema, allow_3_2_features: true)
+```
+
+Some 3.1 and 3.2 features are parsed or detected but do not affect runtime validation:
+
+- `contentEncoding`, `contentMediaType`, and `contentSchema` (3.1) are parsed but not validated
+- `$dynamicRef` and `$dynamicAnchor` (3.1) are not resolved
+- `$self` (3.2) is parsed (`OpenAPI#self_uri`) but not used as the base URI for `$ref` resolution
+- `itemSchema` (3.2) is parsed but not used to validate sequential media type bodies (SSE, JSON Lines, JSON Sequences)
+- parameters with `in: querystring` (3.2) are not validated
+- Tag, Server, Example, XML, and Security Scheme objects are not modeled; they are only checked by the `SpecValidator`
+
+Version-specific correctness is checked separately by the `SpecValidator`, driven by the `strict_specification_version` option:
+
+- `:silent` (default) — no version checks
+- `:warn` — print a warning for each mismatch (e.g. a 3.1-only keyword in a 3.0 document)
+- `:raise` — raise `OpenAPIParser::SpecViolationError` listing all mismatches
+
+```ruby
+OpenAPIParser.parse(schema, strict_specification_version: :raise)
+# => raises OpenAPIParser::SpecViolationError if e.g. a 3.0 document uses `prefixItems`
+```
+
+Detected mismatches:
+
+- 3.1 additions in 3.0 documents: `const`, `prefixItems`, array-form `type`, `type: "null"`, `webhooks`, `jsonSchemaDialect`, `components.pathItems`, `$dynamicRef`, `$dynamicAnchor`, `contentEncoding`, `contentMediaType`, `contentSchema`, `$defs`, boolean schemas
+- the 3.0 Boolean vs 3.1 numeric forms of `exclusiveMinimum` / `exclusiveMaximum`
+- 3.2 additions in earlier documents: `$self`, the `query` operation, `additionalOperations`, `components.mediaTypes`, Tag `summary` / `parent` / `kind`, Server `name`, Example `dataValue` / `serializedValue`, XML `nodeType`, Security Scheme `deprecated` / `oauth2MetadataUrl` and the `deviceAuthorization` flow, Media Type and Encoding `itemSchema` / `itemEncoding` / `prefixEncoding`, Discriminator `defaultMapping`, Parameter `in: querystring` and `style: cookie`, Response `summary`
+- keywords removed or deprecated by the declared version: `nullable` and singular schema `example` in 3.1+, XML `attribute: true` / `wrapped: true` and Parameter `allowEmptyValue` in 3.2
+
 ## ToDo
 - correct schema checker
 - more detailed validator

data/lib/openapi_parser/concerns/media_type_selectable.rb

@@ -1,4 +1,22 @@
 module OpenAPIParser::MediaTypeSelectable
+  # `content` accepts $refs only where 3.2 runtime behavior applies; before
+  # 3.2 a `$ref` there is parsed as a MediaType with no schema, as it always was
+  CONTENT_REFERENCE = ->(target) { target.root.use_3_2_features? }
+
+  # A `content` $ref left unresolved (strict_reference_validation off) falls
+  # back to a schemaless MediaType instead of staying a Reference
+  def expand_reference(root, validate_references)
+    super
+
+    content&.each do |key, media_type|
+      next unless media_type.kind_of?(OpenAPIParser::Schemas::Reference)
+
+      fallback = OpenAPIParser::Schemas::MediaType.new(media_type.object_reference, self, root, media_type.raw_schema)
+      _update_child_object(media_type, fallback)
+      content[key] = fallback
+    end
+  end
+
   private
 
     # select media type by content_type (consider wild card definition)

data/lib/openapi_parser/concerns/schema_loader/creator.rb

@@ -26,12 +26,17 @@ class OpenAPIParser::SchemaLoader::Creator < OpenAPIParser::SchemaLoader::Base
       check_object_schema?(check_schema) && !check_schema['$ref'].nil?
     end
 
+    # `reference:` is a Boolean, or a Proc taking the owning object
+    def allow_reference?(target_object)
+      @allow_reference.respond_to?(:call) ? @allow_reference.call(target_object) : @allow_reference
+    end
+
     def check_object_schema?(check_schema)
       check_schema.kind_of?(::Hash)
     end
 
     def escape_reference(str)
-      str.to_s.gsub('/', '~1')
+      str.to_s.gsub('~', '~0').gsub('/', '~1')
     end
 
     def build_openapi_object_from_option(target_object, ref, schema)
@@ -39,7 +44,7 @@ class OpenAPIParser::SchemaLoader::Creator < OpenAPIParser::SchemaLoader::Base
 
       if @allow_data_type && !check_object_schema?(schema)
         schema
-      elsif @allow_reference && check_reference_schema?(schema)
+      elsif allow_reference?(target_object) && check_reference_schema?(schema)
         OpenAPIParser::Schemas::Reference.new(ref, target_object, target_object.root, schema)
       else
         @klass.new(ref, target_object, target_object.root, schema)

data/lib/openapi_parser/concerns/schema_loader/hash_body_loader.rb

@@ -21,7 +21,7 @@ class OpenAPIParser::SchemaLoader::HashBodyLoader < OpenAPIParser::SchemaLoader:
     # for responses and paths object
     def create_hash_body_objects(target_object, raw_schema)
       object_list = raw_schema.reject { |k, _| reject_keys.include?(k) }.map do |child_name, child_schema|
-        ref = build_object_reference_from_base(target_object.object_reference, escape_reference(child_name))
+        ref = build_object_reference_from_base(target_object.object_reference, child_name)
         [
           child_name.to_s, # support string key only in OpenAPI3
           build_openapi_object_from_option(target_object, ref, child_schema),

data/lib/openapi_parser/config.rb

@@ -15,6 +15,11 @@ class OpenAPIParser::Config
     @config.fetch(:allow_empty_date_and_datetime, false)
   end
 
+  # apply OpenAPI 3.2 runtime behavior to documents that declare an earlier version
+  def allow_3_2_features
+    @config.fetch(:allow_3_2_features, false)
+  end
+
   def datetime_coerce_class
     @config[:datetime_coerce_class]
   end

data/lib/openapi_parser/errors.rb

@@ -112,6 +112,18 @@ module OpenAPIParser
     end
   end
 
+  # raised for a value that is valid against the `not` schema
+  class NotSchemaMatched < OpenAPIError
+    def initialize(value, reference)
+      super(reference)
+      @value = value
+    end
+
+    def message
+      "#{@value.inspect} must not be valid against #{@reference}"
+    end
+  end
+
   class NotEnumInclude < OpenAPIError
     def initialize(value, reference)
       super(reference)
@@ -123,6 +135,18 @@ module OpenAPIParser
     end
   end
 
+  class NotMultipleOf < OpenAPIError
+    def initialize(value, multiple_of, reference)
+      super(reference)
+      @value = value
+      @multiple_of = multiple_of
+    end
+
+    def message
+      "#{@value.inspect} isn't a multiple of #{@multiple_of.inspect} in #{@reference}"
+    end
+  end
+
   class LessThanMinimum < OpenAPIError
     def initialize(value, reference)
       super(reference)

data/lib/openapi_parser/schema_validator/any_of_validator.rb

@@ -7,7 +7,7 @@ class OpenAPIParser::SchemaValidator
         return [value, nil]
       end
       if schema.discriminator
-        return validate_discriminator_schema(schema.discriminator, value)
+        return validate_discriminator_schema(schema.discriminator, value, candidate_schemas: schema.any_of)
       end
 
       # in all schema return error (=true) not any of data

data/lib/openapi_parser/schema_validator/base.rb

@@ -12,19 +12,32 @@ class OpenAPIParser::SchemaValidator
       raise 'need implement'
     end
 
-    def validate_discriminator_schema(discriminator, value, parent_discriminator_schemas: [])
+    def validate_discriminator_schema(discriminator, value, candidate_schemas: nil, parent_discriminator_schemas: [])
       property_name = discriminator.property_name
-      if property_name.nil? || !value.key?(property_name)
-        return [nil, OpenAPIParser::NotExistDiscriminatorPropertyName.new(discriminator.property_name, value, discriminator.object_reference)]
+      if property_name && value.key?(property_name)
+        mapping_key = value[property_name]
+        explicit_target = discriminator.mapping&.[](mapping_key)
+        if explicit_target
+          mapping_target = explicit_target
+          resolved_schema = discriminator.root.find_object(mapping_target)
+        else
+          mapping_target = "#/components/schemas/#{mapping_key}"
+          # Implicit values are component names, not reference paths.
+          resolved_schema = discriminator.root.components&.schemas&.[](mapping_key.to_s)
+          resolved_schema = nil if candidate_schemas && resolved_schema && !candidate_schemas.include?(resolved_schema)
+        end
       end
-      mapping_key = value[property_name]
 
-      # it's allowed to have discriminator without mapping, then we need to lookup discriminator.property_name
-      # but the format is not the full path, just model name in the components
-      mapping_target = discriminator.mapping&.[](mapping_key) || "#/components/schemas/#{mapping_key}"
+      # defaultMapping (3.2) applies when the property is absent or its value
+      # has neither an explicit mapping nor an implicit schema match
+      if resolved_schema.nil? && explicit_target.nil? && (default_target = default_mapping_target(discriminator))
+        mapping_target = default_target
+        resolved_schema = discriminator.root.find_object(default_target)
+      end
 
-      # Find object does O(n) search at worst, then caches the result, so this is ok for repeated search
-      resolved_schema = discriminator.root.find_object(mapping_target)
+      unless mapping_target
+        return [nil, OpenAPIParser::NotExistDiscriminatorPropertyName.new(discriminator.property_name, value, discriminator.object_reference)]
+      end
 
       unless resolved_schema
         return [nil, OpenAPIParser::NotExistDiscriminatorMappedSchema.new(mapping_target, discriminator.object_reference)]
@@ -35,5 +48,18 @@ class OpenAPIParser::SchemaValidator
         **{discriminator_property_name: discriminator.property_name, parent_discriminator_schemas: parent_discriminator_schemas}
       )
     end
+
+    private
+
+      # defaultMapping holds a schema name or a URI reference; only
+      # same-document references resolve. Ignored where 3.2 behavior doesn't apply
+      def default_mapping_target(discriminator)
+        return nil unless discriminator.root.use_3_2_features?
+
+        target = discriminator.default_mapping
+        return nil unless target.is_a?(String)
+
+        target.start_with?('#') || target.include?('/') ? target : "#/components/schemas/#{target}"
+      end
   end
 end

data/lib/openapi_parser/schema_validator/float_validator.rb

@@ -2,6 +2,7 @@ class OpenAPIParser::SchemaValidator
   class FloatValidator < Base
     include ::OpenAPIParser::SchemaValidator::Enumable
     include ::OpenAPIParser::SchemaValidator::MinimumMaximum
+    include ::OpenAPIParser::SchemaValidator::MultipleOf
 
     # validate float value by schema
     # @param [Object] value
@@ -22,6 +23,9 @@ class OpenAPIParser::SchemaValidator
         value, err = check_enum_include(value, schema)
         return [nil, err] if err
 
+        value, err = check_multiple_of(value, schema)
+        return [nil, err] if err
+
         check_minimum_maximum(value, schema)
       end
 

data/lib/openapi_parser/schema_validator/integer_validator.rb

@@ -2,6 +2,7 @@ class OpenAPIParser::SchemaValidator
   class IntegerValidator < Base
     include ::OpenAPIParser::SchemaValidator::Enumable
     include ::OpenAPIParser::SchemaValidator::MinimumMaximum
+    include ::OpenAPIParser::SchemaValidator::MultipleOf
 
     # validate integer value by schema
     # @param [Object] value
@@ -9,14 +10,29 @@ class OpenAPIParser::SchemaValidator
     def coerce_and_validate(value, schema, **_keyword_args)
       value = coerce(value) if @coerce_value
 
-      return OpenAPIParser::ValidateError.build_error_result(value, schema) unless value.kind_of?(Integer)
+      return OpenAPIParser::ValidateError.build_error_result(value, schema) unless integer?(value, schema)
 
       value, err = check_enum_include(value, schema)
       return [nil, err] if err
 
+      value, err = check_multiple_of(value, schema)
+      return [nil, err] if err
+
       check_minimum_maximum(value, schema)
     end
 
+    # 3.1 follows JSON Schema, where 1.0 is an integer. 3.0 defines an
+    # integer as a number without a fraction, so 1.0 is not one there.
+    # @param [Object] value
+    # @param [OpenAPIParser::Schemas::Schema] schema
+    # @return [Boolean]
+    def integer?(value, schema)
+      return true if value.kind_of?(Integer)
+      return false unless value.kind_of?(Float) && value.finite? && value == value.floor
+
+      schema.root.use_3_1_features?
+    end
+
     private
 
       def coerce(value)

data/lib/openapi_parser/schema_validator/multiple_of.rb

@@ -0,0 +1,26 @@
+class OpenAPIParser::SchemaValidator
+  module MultipleOf
+    # check multipleOf by schema
+    # @param [Numeric] value
+    # @param [OpenAPIParser::Schemas::Schema] schema
+    def check_multiple_of(value, schema)
+      multiple_of = schema.multipleOf
+      # multipleOf MUST be a number strictly greater than 0; ignore an invalid one.
+      return [value, nil] unless multiple_of.is_a?(Numeric) && multiple_of.positive?
+      return [value, nil] if (exact(value) % exact(multiple_of)).zero?
+
+      [nil, OpenAPIParser::NotMultipleOf.new(value, multiple_of, schema.object_reference)]
+    end
+
+    private
+
+      # A Float such as 0.01 is not exact in binary, so 19.99 % 0.01 is not zero.
+      # Both numbers come from decimal text in JSON or YAML, so divide them as
+      # the decimals that Float#to_s gives back.
+      def exact(number)
+        return Rational(number.to_s) if number.is_a?(Float) && number.finite?
+
+        number
+      end
+  end
+end

data/lib/openapi_parser/schema_validator/nil_validator.rb

@@ -1,5 +1,7 @@
 class OpenAPIParser::SchemaValidator
   class NilValidator < Base
+    include ::OpenAPIParser::SchemaValidator::Enumable
+
     # @param [Object] value
     # @param [OpenAPIParser::Schemas::Schema] schema
     def coerce_and_validate(value, schema, **_keyword_args)
@@ -8,6 +10,8 @@ class OpenAPIParser::SchemaValidator
       return [value, nil] if schema.type == 'null'
       # 3.1: `type: [..., "null"]` lets nil coexist with another primitive.
       return [value, nil] if schema.type.is_a?(Array) && schema.type.include?('null')
+      # A schema without `type` accepts null, as in JSON Schema. `enum` still applies.
+      return check_enum_include(value, schema) if schema.type.nil?
 
       [nil, OpenAPIParser::NotNullError.new(schema.object_reference)]
     end

data/lib/openapi_parser/schema_validator/one_of_validator.rb

@@ -7,7 +7,7 @@ class OpenAPIParser::SchemaValidator
         return [value, nil]
       end
       if schema.discriminator
-        return validate_discriminator_schema(schema.discriminator, value)
+        return validate_discriminator_schema(schema.discriminator, value, candidate_schemas: schema.one_of)
       end
 
       # if multiple schemas are satisfied, it's not valid

data/lib/openapi_parser/schema_validator.rb

@@ -1,6 +1,7 @@
 require_relative 'schema_validator/options'
 require_relative 'schema_validator/enumable'
 require_relative 'schema_validator/minimum_maximum'
+require_relative 'schema_validator/multiple_of'
 require_relative 'schema_validator/properties_number'
 require_relative 'schema_validator/base'
 require_relative 'schema_validator/string_validator'
@@ -37,6 +38,10 @@ class OpenAPIParser::SchemaValidator
 
   include Validatable
 
+  # Types to pick from for a schema without `type`. integer comes before
+  # number so that an Integer is checked as an integer.
+  VALUE_TYPES = %w[object array string integer number boolean].freeze
+
   class << self
     # validate schema data
     # @param [Hash] value
@@ -89,6 +94,12 @@ class OpenAPIParser::SchemaValidator
       return [nil, OpenAPIParser::ValidateError.new(value, "const #{schema.const.inspect}", schema.object_reference)] if value != schema.const
     end
 
+    # `not` rejects a value that is valid against its schema.
+    if schema.respond_to?(:not) && schema.not.is_a?(OpenAPIParser::Schemas::Schema)
+      _, not_error = validate_schema(value, schema.not)
+      return [nil, OpenAPIParser::NotSchemaMatched.new(value, schema.not.object_reference)] unless not_error
+    end
+
     return coerce_into_type_array(value, schema, **keyword_args) if coerce_into_type_array?(value, schema)
 
     if (v = validator(value, schema))
@@ -120,6 +131,11 @@ class OpenAPIParser::SchemaValidator
       return one_of_validator if schema.one_of
       return nil_validator if value.nil?
 
+      # 3.1: `format: binary` with `string` in an array-form `type` accepts a
+      # non-String object such as an uploaded file, the same way as a single
+      # `type: string`. The string validator skips the check for `binary`.
+      return string_validator if binary_string_in_type_array?(value, schema)
+
       # 3.1: pick the type from an Array whose primitive class matches the
       # value, then dispatch as if it were a single-type schema. If nothing
       # matches we still pick a candidate so the relevant validator emits
@@ -127,12 +143,16 @@ class OpenAPIParser::SchemaValidator
       # fallback.
       effective_type = schema.type
       if effective_type.is_a?(Array)
-        matched = pick_array_type(value, effective_type)
+        matched = pick_type(value, effective_type, schema)
         return type_mismatch_validator if matched.nil?
 
         effective_type = matched
       end
 
+      # JSON Schema applies each keyword when the value has the type the
+      # keyword is for, whether or not `type` is set.
+      effective_type ||= pick_type(value, VALUE_TYPES, schema)
+
       validator_for_type(effective_type)
     end
 
@@ -161,6 +181,14 @@ class OpenAPIParser::SchemaValidator
       end
     end
 
+    # 3.1: a non-String value for an array-form `type` that lists `string`
+    # with `format: binary`, such as an uploaded file object.
+    def binary_string_in_type_array?(value, schema)
+      return false if value.is_a?(String)
+
+      schema.format == 'binary' && schema.type.is_a?(Array) && schema.type.include?('string')
+    end
+
     # 3.1: when coercing, a value whose class matches no listed type is tried
     # against each listed type, the same way a single `type` coerces it.
     # Request params arrive as Strings ("5" for `type: [integer, "null"]`),
@@ -171,7 +199,7 @@ class OpenAPIParser::SchemaValidator
       return false unless @coerce_value && !value.nil?
       return false if schema.any_of || schema.all_of || schema.one_of
 
-      schema.type.is_a?(Array) && pick_array_type(value, schema.type).nil?
+      schema.type.is_a?(Array) && pick_type(value, schema.type, schema).nil?
     end
 
     # 3.1: returns the first listed type that coerces, or the first type's error.
@@ -198,11 +226,11 @@ class OpenAPIParser::SchemaValidator
       @type_mismatch_validator ||= OpenAPIParser::SchemaValidator::TypeMismatchValidator.new(self, @coerce_value)
     end
 
-    def pick_array_type(value, types)
+    def pick_type(value, types, schema)
       types.find do |t|
         case t
         when 'string'  then value.is_a?(String)
-        when 'integer' then value.is_a?(Integer)
+        when 'integer' then integer_validator.integer?(value, schema)
         when 'number'  then value.is_a?(Numeric)
         when 'boolean' then value == true || value == false
         when 'array'   then value.is_a?(Array)

data/lib/openapi_parser/schemas/components.rb

@@ -28,5 +28,9 @@ module OpenAPIParser::Schemas
     # @!attribute [r] path_items
     #   @return [Hash{String => PathItem}, nil] path item objects (OpenAPI 3.1+)
     openapi_attr_hash_object :path_items, PathItem, reference: true, schema_key: :pathItems
+
+    # @!attribute [r] media_types
+    #   @return [Hash{String => MediaType}, nil] media type objects (OpenAPI 3.2+)
+    openapi_attr_hash_object :media_types, MediaType, reference: true, schema_key: :mediaTypes
   end
 end

data/lib/openapi_parser/schemas/discriminator.rb

@@ -7,5 +7,9 @@ module OpenAPIParser::Schemas
     # @!attribute [r] mapping
     #   @return [Hash{String => String]
     openapi_attr_value :mapping
+
+    # @!attribute [r] default_mapping
+    #   @return [String, nil] fallback schema name or reference (OpenAPI 3.2+)
+    openapi_attr_value :default_mapping, schema_key: :defaultMapping
   end
 end

data/lib/openapi_parser/schemas/media_type.rb

@@ -8,6 +8,10 @@ module OpenAPIParser::Schemas
     #   @return [Schema, nil] OpenAPI3 Schema object
     openapi_attr_object :schema, Schema, reference: true
 
+    # @!attribute [r] item_schema
+    #   @return [Schema, nil] schema for each item of a sequential media type (OpenAPI 3.2+); not yet used for validation
+    openapi_attr_object :item_schema, Schema, reference: true, schema_key: :itemSchema
+
     # validate params by schema definitions
     # @param [Hash] params
     # @param [OpenAPIParser::SchemaValidator::Options] options

data/lib/openapi_parser/schemas/openapi.rb

@@ -5,11 +5,14 @@
 
 module OpenAPIParser::Schemas
   class OpenAPI < Base
-    def initialize(raw_schema, config, uri: nil, schema_registry: {})
+    # @param [OpenAPIParser::Schemas::OpenAPI, nil] referrer the document whose $ref loads this one
+    def initialize(raw_schema, config, uri: nil, schema_registry: {}, referrer: nil)
+      # set before super: child objects consult use_3_2_features? while they're built
+      @config = config
+      @referrer = referrer
       super('#', nil, self, raw_schema)
       @find_object_cache = {}
       @path_item_finder = OpenAPIParser::PathItemFinder.new(paths) if paths # invalid definition
-      @config = config
       @uri = uri
       @schema_registry = schema_registry
 
@@ -33,6 +36,33 @@ module OpenAPIParser::Schemas
       Gem::Version.new(openapi).release
     end
 
+    # Whether OpenAPI 3.1 runtime behavior applies where 3.0 and 3.1 define
+    # the same thing differently: the document declares 3.1 or later. A
+    # referenced file that declares no version follows the document that
+    # loaded it.
+    # @return [Boolean]
+    def use_3_1_features?
+      version = openapi_version
+      return version >= Gem::Version.new('3.1') if version
+      return @referrer.use_3_1_features? if openapi.nil? && @referrer
+
+      false
+    end
+
+    # Whether OpenAPI 3.2 runtime behavior applies: the document declares 3.2
+    # or later, or the allow_3_2_features config is set. A referenced file
+    # that declares no version follows the document that loaded it.
+    # @return [Boolean]
+    def use_3_2_features?
+      return true if @config.allow_3_2_features
+
+      version = openapi_version
+      return version >= Gem::Version.new('3.2') if version
+      return @referrer.use_3_2_features? if openapi.nil? && @referrer
+
+      false
+    end
+
     # @!attribute [r] paths
     #   @return [Paths, nil]
     openapi_attr_object :paths, Paths, reference: false
@@ -59,6 +89,9 @@ module OpenAPIParser::Schemas
 
     # @return [OpenAPIParser::RequestOperation, nil]
     def request_operation(http_method, request_path)
+      # 3.1: `paths` is optional (a document may have only `webhooks`), so there is nothing to find
+      return nil unless @path_item_finder
+
       OpenAPIParser::RequestOperation.create(http_method, request_path, @path_item_finder, @config)
     end
 
@@ -71,7 +104,7 @@ module OpenAPIParser::Schemas
       loaded = @schema_registry[resolved_uri]
       return loaded if loaded
 
-      OpenAPIParser.load_uri(resolved_uri, config: @config, schema_registry: @schema_registry)
+      OpenAPIParser.load_uri(resolved_uri, config: @config, schema_registry: @schema_registry, referrer: self)
     end
 
     private