Fix #192

non deterministic error handling was the issue.

Author: daveshanley

validator.go

@@ -1,11 +1,12 @@
-// Copyright 2023 Princess B33f Heavy Industries / Dave Shanley
+// Copyright 2023-2025 Princess Beef Heavy Industries, LLC / Dave Shanley
 // SPDX-License-Identifier: MIT
 
 package validator
 
 import (
 	"fmt"
 	"net/http"
+	"sort"
 	"sync"
 
 	"github.com/pb33f/libopenapi"
@@ -292,6 +293,10 @@ func (v *validator) ValidateHttpRequestWithPathItem(request *http.Request, pathI
 
 	// wait for all the validations to complete
 	<-doneChan
+
+	// sort errors for deterministic ordering (async validation can return errors in any order)
+	sortValidationErrors(validationErrors)
+
 	return len(validationErrors) == 0, validationErrors
 }
 
@@ -372,6 +377,17 @@ type (
 	validationFunctionAsync func(control chan struct{}, errorChan chan []*errors.ValidationError)
 )
 
+// sortValidationErrors sorts validation errors for deterministic ordering.
+// Errors are sorted by validation type first, then by message.
+func sortValidationErrors(errs []*errors.ValidationError) {
+	sort.Slice(errs, func(i, j int) bool {
+		if errs[i].ValidationType != errs[j].ValidationType {
+			return errs[i].ValidationType < errs[j].ValidationType
+		}
+		return errs[i].Message < errs[j].Message
+	})
+}
+
 // warmSchemaCaches pre-compiles all schemas in the OpenAPI document and stores them in the validator caches.
 // This frontloads the compilation cost so that runtime validation doesn't need to compile schemas.
 func warmSchemaCaches(

validator_examples_test.go

@@ -121,8 +121,7 @@ func ExampleNewValidator_validateHttpRequestSync() {
 			fmt.Printf("Type: %s, Failure: %s\n", e.ValidationType, e.Message)
 		}
 	}
-	// Type: parameter, Failure: Path parameter 'petId' is not a valid integer
-	// Output: Type: security, Failure: API Key api_key not found in header
+	// Output: Type: parameter, Failure: Path parameter 'petId' is not a valid integer
 }
 
 func ExampleNewValidator_validateHttpRequestResponse() {

validator_test.go

@@ -2395,3 +2395,46 @@ paths:
 	})
 	assert.Greater(t, count, 0, "Schema cache should have entries from path-level parameters")
 }
+
+// TestSortValidationErrors tests that validation errors are sorted deterministically
+func TestSortValidationErrors(t *testing.T) {
+	// Create errors in random order
+	errs := []*errors.ValidationError{
+		{ValidationType: "security", Message: "API Key missing"},
+		{ValidationType: "parameter", Message: "Path param invalid"},
+		{ValidationType: "request", Message: "Body invalid"},
+		{ValidationType: "parameter", Message: "Header missing"},
+		{ValidationType: "security", Message: "Auth header missing"},
+	}
+
+	sortValidationErrors(errs)
+
+	// Verify sorted by validation type first, then by message
+	assert.Equal(t, "parameter", errs[0].ValidationType)
+	assert.Equal(t, "Header missing", errs[0].Message)
+	assert.Equal(t, "parameter", errs[1].ValidationType)
+	assert.Equal(t, "Path param invalid", errs[1].Message)
+	assert.Equal(t, "request", errs[2].ValidationType)
+	assert.Equal(t, "Body invalid", errs[2].Message)
+	assert.Equal(t, "security", errs[3].ValidationType)
+	assert.Equal(t, "API Key missing", errs[3].Message)
+	assert.Equal(t, "security", errs[4].ValidationType)
+	assert.Equal(t, "Auth header missing", errs[4].Message)
+}
+
+// TestSortValidationErrors_Empty tests sorting empty slice
+func TestSortValidationErrors_Empty(t *testing.T) {
+	errs := []*errors.ValidationError{}
+	sortValidationErrors(errs)
+	assert.Empty(t, errs)
+}
+
+// TestSortValidationErrors_SingleElement tests sorting single element slice
+func TestSortValidationErrors_SingleElement(t *testing.T) {
+	errs := []*errors.ValidationError{
+		{ValidationType: "parameter", Message: "Invalid value"},
+	}
+	sortValidationErrors(errs)
+	assert.Len(t, errs, 1)
+	assert.Equal(t, "parameter", errs[0].ValidationType)
+}