Joi is a JavaScript data validation and schema description library, used to define and validate structured data. It provides documentation and an API via the joi.dev developer portal, along with versions status and a changelog.
Project status
- Actively maintained: The upstream GitHub activity and recent published version updates are very recent (latest push on 2026-09-02, with multiple updates published on that date), suggesting ongoing active development rather than maintenance mode.
- Update cadence: There is high clustering in late August and early September 2026 (for example, several updates on 2026-08-19 and at least two on 2026-09-02). There is also a longer mid-year gap (for example, 2026-06-17 to 2026-08-19), so cadence appears bursty but active.
AI summary generated
Recent updates
v18.2.8
v18.2.8 includes internal changes to how Joi orders and rebuilds object schema keys, plus new tests around circular sibling references and errors caused by rebuild/fork operations. There are also small internal cloning/copying changes in core classes (Base, Ids, and ref manager). No release notes were provided, so behavioral impact must be inferred from the diff.
v18.2.7
Release v18.2.7 includes internal validator changes around how Joi handles failover, specifically around rolling back externals and warnings registered during validation of a value that later gets replaced by failover. It also updates the validator state snapshot mechanism to use list lengths instead of array copies, reducing allocation overhead.
Breakingv17.13.7
v17.13.7 introduces runtime-safety and prototype-pollution hardening around link resolution and object key renaming. It also adjusts ISO date time zone parsing for a specific timeshift format and adds new validation error codes to reflect these behaviors.
BreakingSecurityFeaturesv18.2.6
v18.2.6 has no published release notes, but the code diff shows a substantial internal refactor plus new JSON Schema generation logic across many Joi types. It also introduces a new link recursion control API (maxRecursion) and changes core string/boolean normalization behavior due to swapped validation backends.
Featuresv17.13.6
Release v17.13.6 (patch) introduces a fix to how Joi compiles and merges localized messages. The change prevents prototype pollution when message “language” keys such as "__proto__" or "constructor" are used, and it adds regression tests for these cases.
Securityv18.2.5
Release v18.2.5 contains a small functional change to `Joi.string().email()` options to accept a new `allowUnderscore` setting, plus internal hardening around message compilation/merging to avoid prototype pollution issues when language keys such as `__proto__` or `constructor` are used. There were no release notes provided by the publisher, so the changes below are inferred strictly from the code diff.
SecurityFeaturesv17.13.5
This release introduces runtime safety and additional hardening in Joi validation, specifically around recursive link resolution and prototype pollution vectors involving __proto__. It adds new validation error codes (link.depth and object.rename.proto) and updates internal cloning/renaming behavior to prevent prototype tampering.
BreakingSecurityFeaturesv18.2.4
v18.2.4 contains a large internal refactor plus substantial additions to JSON Schema generation across many Joi types (alternatives, array, binary, date, keys, link, number, string). It also changes runtime validation behavior in a few places (notably link recursion handling, boolean string normalization, and string address validation dependencies). No release notes were provided, so the following impacts are inferred directly from the code diff.
Featuresv18.2.3
Release v18.2.3 ships no publisher release notes. Based on the code diff, it primarily adjusts internal cloning and JSON schema generation for string patterns, and adds tests around prototype pollution and multi-pattern composition.
Securityv18.2.2
No release notes were provided for v18.2.2, so the documented change set is effectively empty. The code diff indicates substantial internal refactoring plus additions centered around JSON Schema generation across multiple types, along with runtime behavior changes in link recursion handling and async detection for alternatives.
BreakingFeaturesv17.13.4
Release v17.13.4 was published on 2026-06-12, but the publisher did not provide any release notes or change log details. No specific new features, fixes, or breaking changes can be identified from the provided information.
v18.2.1
This release (v18.2.1) changes how Joi.link() validation behaves when resolving deeply recursive links exceeds the runtime call stack. Instead of propagating a RangeError, the code now converts the failure into a validation error with a new error code, `link.depth`, and updates documentation and tests accordingly.
Featuresv18.2.0
This release adds a new Joi.link() option, `maxRecursion(limit)`, which caps how many times the same link may be entered during a single validation chain. The change introduces a new validation error code, `link.maxRecursion`, and updates TypeScript typings, API docs, and tests accordingly.
Featuresv18.1.2
Release v18.1.2 contains changes to Joi's JSON Schema generation for number rules. It adds JSON Schema output for number.port(), and it changes how Joi.number().positive() and Joi.number().negative() represent constraints, moving from a custom x-constraint field to standard JSON Schema exclusiveMinimum/exclusiveMaximum.
Featuresv18.1.1
v18.1.1 ships a small set of behavioral changes to Joi validation plumbing, template parsing, and number schema description/allow handling. No release notes were provided by the publisher, so all observed changes below are undocumented from the release-notes perspective.
Featuresv18.1.0
The publisher provided no release notes for v18.1.0. The code diff indicates a major addition: JSON Schema generation integrated with the Standard Schema spec via the `schema['~standard'].jsonSchema.input()` and `output()` APIs, including a new internal converter in `lib/base.js` and `jsonSchema` hooks across many Joi types and rules.
Featuresv18.0.2
Release v18.0.2 includes a small behavior change to boolean coercion, plus an accompanying unit test. No release notes were provided, so the only documented information is what appears in the code diff.
v18.0.1
Release v18.0.1 was published, but no release notes were provided by the publisher. As a result, this release cannot be assessed for new features, breaking changes, bug fixes, security, or dependency changes based on documented information.