chore(deps): bump joi from 17.13.4 to 18.2.3

[dependabot]

Bumps joi from 17.13.4 to 18.2.3.

Commits

• c86ddc0 18.2.3
• 8077125 Merge pull request #3125 from hapijs/fix/json-schema-multiple-patterns
• 223217a fix: expose multiple string patterns in json schemas
• 85947a8 Merge pull request #3124 from hapijs/chore/object-proto
• fe41c4f chore: deny prototype pollution in objects by restoring prototype
• 87d3a62 18.2.2
• 1c7d34e Merge pull request #3120 from hapijs/fix/json-schema-bugfixes
• 515a8f0 test(json-schema): drop runtime validation from json-schema tests
• 6574f75 fix(json-schema): register id'd child schemas in $defs
• 770a2cf fix(json-schema): skip rule handlers with ref arguments
• Additional commits viewable in compare view

---

Note

Medium Risk
Major bump on the library that validates all Express request payloads; subtle rule differences could reject or accept requests that passed on 17.x without any code edits in this PR.

Overview
Bumps joi from 17.13.4 to 18.2.3 in package.json and refreshes package-lock.json only—no application source changes.

Joi 18 is a major release: validation internals move from @sideway/* to @hapi/* (address, formula, pinpoint), adds @hapi/tlds and @standard-schema/spec, and requires Node ≥ 20 (this repo already targets Node ≥ 24). Upstream also includes hardening around object prototype handling and JSON Schema export fixes.

Because express-joi-validation on v1/v2 routes still depends on these Joi schemas, reviewers should treat this as a behavioral dependency upgrade: run the existing API/validation test suites and spot-check endpoints that use string/email/domain rules, where Joi 18 may accept or reject inputs differently than 17.

^{Reviewed by Cursor Bugbot for commit 5b106a0. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	joi@​17.13.4 ⏵ 18.2.3			+1

View full report

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 366541c. Configure here.}

[cursor]

Joi peer mismatch express-joi-validation

Medium Severity

This commit upgrades joi to ^18.2.3 while express-joi-validation ^6.1.0 remains unchanged and declares a peer dependency on joi major version 17. That unsupported pairing can cause npm install/ERESOLVE failures on clean installs (including the Docker npm install path) and leaves all Express request validation on an untested middleware–Joi combination.

 

^{Reviewed by Cursor Bugbot for commit 366541c. Configure here.}