Handling of nullable in reference object

[pebo]

Describe the bug When switching to express-openapi-validator one of our existing schemas failed request validation for nullable nested objects in combination with oneOf.

express-openapi-validator versions tested: 5.0.3 and 5.0.4

To Reproduce Given the following spec:

openapi: 3.0.0
info:
  description: Demo
  version: 1.0.0
  title: demo-api
paths:
  "/demo":
    post:
      operationId: demoId
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: "#/components/schemas/DemoRequest"
      responses:
        "200":
          description: demo
          content:
            text/plain:
              schema:
                type: string

components:
  schemas:
    DemoRequest:
      type: object
      required:
        - items
      properties:
        items:
          type: array
          minItems: 1
          items:
            oneOf:
              - $ref: "#/components/schemas/TypeA"

    TypeA:
      type: object
      required:
        - id
        - opt
      properties:
        id:
          type: string
        opt:
          type: object
          $ref: "#/components/schemas/Opt"

    Opt:
      type: object
      nullable: true
      required:
        - foo
      properties:
        foo:
          type: string

Actual behavior Requests with the items array containing an object with the opt property set to null fails, e.g.

curl --location --request POST 'http://localhost:8080/demo' \
--header 'Content-Type: application/json' \
--data-raw '{
  "items":[
    {
      "id":"123",
      "opt": null
    }
  ]
}'

Error message:

{"message":"request/body/items/0/opt must be object, request/body/items/0 must match exactly one schema in oneOf"}

Expected behavior The request should succeed w/o request validation errors.

Examples and context A workaround seems to be adding nullable: true as a sibling to the $ref:

        opt:
          type: object
          $ref: "#/components/schemas/Opt"
          nullable: true

Note that nullable: true seems to be required in two places for the validation to work.

[GWellerGMSL]

OAS 3.1 support seems to have broken validation for OAS 3.0 schemas with nullable refs. Can't use version 5 until this is fixed.

[cdimascio]

@GWellerGMSL oas 3.1 support was added in v5.4.0. As such 3.1 support has no impact on earlier 5.x versions. Please provid specifics regarding your issue. Cheers!