anyOf/oneOf coerces to property first fitting type (in body response)

[kevinval]

Describe the bug
A property defined as anyOf with a mixture of integer/boolean results in being coerced (cast) to the first type it matches. Additionally using oneOf isn't possible either as both boolean and an integer value will with both types and the match is no longer oneOf.

To Reproduce
Having a schema like this:

type: object
properties:
  key:
    type: string
    description: Key of the setting.
  value:
    anyOf:
      - type: integer
      - type: boolean
      - type: object
    description: Value of the setting.

And having validateResponses: true enabled, when an object like this is passed to the validator:

{
  "key": "boolean_setting",
  "value": false
}

Actual behavior
It comes out of the validator as this:

{
  "key": "boolean_setting",
  "value": 0
}

Expected behavior
The type should be kept as boolean:

{
  "key": "boolean_setting",
  "value": false
}

Examples and context
It also works the other way, if the schema will have boolean first in the list stuff will get coerced to boolean instead - whatever matches first it seems based on coercion rules of AJV.

coerceTypes: false seems to fix this behavior. It also fixes it for oneOf (obviously, I guess). But that's not the best workaround as we do rely on it for eg. URL GET parameters.

I noticed the recent work in #387 and that coerceTypes got deprecated. Is it possible it somehow does not apply to validation of responses? At least from the quick look it seemed to be request-related.

[cdimascio]

@kevinval good catch. PR #387 improves the way request validation is handled. Essentially, it no longer performs type coercion on request bodies. Everything else remains the same (though coerceTypes becomes ambiguous and hence will be removed in the next major version). As you example illustrates, a similar change is needed for response bodies. I'll start work on that.

[cdimascio]

@kevinval this should be fixed in v4.2.0

[kevinval]

confirmed fixed in v4.2.0, thanks for the amazingly fast response :-)