• Don't set undefined values into request when validated key does not exist

• #521 - typescript: add standard sanitizers back to legacy's sanization chain interface

• #525, #528 - typescript: add exists to the schema definition

No more new features will be added to the legacy API! Only bug fixes will be accepted.

BREAKING CHANGES 💥

• #461 - check: sanitizers now persist the sanitized value back to the request. This was previously only the case for sanitizers used from the filter API
• #463 - check: standard validators will now use an array's first item only
• @types/express dependency removed; if you're using express, you must install this yourself now

New features ✨

• #433, #511, #512 - check: bring schema support back with new checkSchema() function
• #445, #481, #516 - check, filter: add support for custom sanitizers via .customSanitizer() chain function
• #466, #469, #489, #498 - check: accept dynamic message creator function in .withMessage()
• #474 - check: add validationResult.withDefaults() which can create a validationResult function with default options set
• check, filter: build custom check/sanitize functions with buildCheckFunction or buildSanitizeFunction, respectively

Other changes 🐛

• #444 - check: make custom validators that resolve a promise succeed without needing to return a truthy value
• #458, #492 - check: partially fix wildcard issues with inexistent fields
• #414, #484 - docs: further describe when and how to use wildcards
• #462 - docs: add .formatWith() example
• #483 - docs: fix locations accepted in matchedData()
• #482 - filter: make oneOf() and matchedData() work together
• #496 - Revamp TypeScript support in the library
• Update validator to v9.4.0

• #434, #446 - check: accept subgroups of validations
• #447, #453 - filter: list locations to get data from when using matchedData()
• #441 - Add nullable option to .optional()

⚠️ Incorrectly tagged version. Not published to npm.

• #425 - Don't sanitize non-string values

• #299 - legacy: use pretty message when validator used in schema doesn't exist
• #401 - typescript: set withMessage() arg type to any
• #406 - docs: fix req.asyncValidationErrors() return value description
• #410 - docs: don't show .throw() without try..catch
• #411 - check: make validationResult work even though no validators ran
• check: add sanitization chain methods
• filter: add standalone sanitization middleware
• Remove deprecation warnings from legacy APIs
• Update validator to v8.2.0

• #398, #403 - don't fail when .withMessage() is called without any validator
• #399 - check: convert value to string just like in v3 (undefined, null, NaN, [] => '')
• #400 - check: use any rejection cause as error message
• #401 - legacy: restore support for non-string error messages

• #392, #393 - Add .formatWith(formatter) to the validation result API
• #390 - Add .exists() to the TypeScript typings

🎉 BIGGEST express-validator rewrite ever! 🎉 🎊

...but with backwards compatibility, because we're cool to our users 😉

Most notable features are the introduction of check and filter APIs.
They are additions to express-validator, previous ways to validate your requests are still here, but under the name "legacy APIs".

Check the README for complete docs and the upgrade guide for version 3 users.

• #383, #384, #389 - Implement the check API
• #385, #294 - Add support for negating validators with .not()
• #386, #347 - Add support for selecting request fields using wildcard *
• #387, #200 - Add oneOf function to emulate OR validations
• #388, #168 - Implement the filter API
• New .exists() validator
• Upgrade to validator v8.1.0

• Add deprecation warnings to req.validationErrors() and req.asyncValidationErrors()
• Add support for Node 8
• #354 - Don't throw error when validator returns null/undefined
• #318, #348, #350, #352 - Fix lots of problems in TypeScript typings!
• #366 - Tests rewritten as unit tests ⚠️ (should make contributors' lives' easier!)

• #337 - Don't share state between multiple instances of express-validator middleware

• #310 - Allow to use fully custom error formatter without TypeScript error

• #300 - customValidators should accept variable number of arguments in TypeScript Definition

• #293 - Move type definition dependencies back to dependencies from devDependencies

Official TypeScript support!

• #288, #290 - Support schema validation in req.checkHeaders()
• #289 - Add TypeScript definitions
• Update validator to ~6.2.0

First major version in a long time! 🎉 🚢

• #268 - Use Express 4 code in examples
• #270, #274 - Update validator to ~6.1.0
• #232 - Support cookies via req.checkCookies() and req.sanitizeCookies()
• #278 - Make headers validation and sanitization case insensitive
• #222, #262, #282 - Check if validation is optional in schema validation to guard against object keys iteration order
• #280 - Improve IDE auto completion for req.checkQuery(), req.checkParams() and req.checkBody()
• #30, #223, #235, #269, #285 - Implement result API via new async method req.getValidationResult()
• #269 - Deprecate methods req.validationErrors() and req.asyncValidationErrors()

• #253 - Restore string formatting via tokens like %0, %1, etc
• #259, #260 - Fix optional usage with schema validation
• Update lodash to 4.16.x

• #256 - Update validator to 5.7.x