
Security News
November CVEs Fell 25% YoY, Driven by Slowdowns at Major CNAs
November CVE publications fell 25% YoY even as 2025 totals rose, showing how a few major CNAs can swing “global” counts and skew perceived risk.
italia-utils
Advanced tools
italia-utils has been deprecated in favor of @pagopa/openapi-codegen-ts.Only the latter will receive updates, so we strongly advice to migrate to the new package. There are no significative differences between the latest version of italia-utils (6.3.1) and the first version of @pagopa/openapi-codegen-ts (7.0.0), so the migration will be painless.
As the latter is just an evolution of the first, both packages share the very same repository and hence the same version history.
If you need to fix somtheing or add a new feature, please do it in the master branch.
This package provide some tools that are used across the projects of the Digital Citizenship initiative.
To add the tools to a project:
$ yarn add -D italia-utils
This tool generates TypeScript definitions of OpenAPI specs.
In simple terms it converts an OpenAPI spec like this one into:
Note: the generated models requires the runtime dependency italia-ts-commons.
$ gen-api-models --help
Options:
--version Show version number [boolean]
--api-spec Path to input OpenAPI spec file [string] [required]
--strict Generate strict interfaces (default: true)
[default: true]
--out-dir Output directory to store generated definition files
[string] [required]
--ts-spec-file If defined, converts the OpenAPI specs to TypeScript
source and writes it to this file [string]
--request-types Generate request types (default: false)
[default: false]
--response-decoders Generate response decoders (default:
false, implies --request-types) [default: false]
--client Generate request client SDK [default: false]
--default-success-type Default type for success responses (
default: 'undefined') [string] [default: "undefined"]
--default-error-type Default type for error responses (
default: 'undefined') [string] [default: "undefined"]
--help Show help [boolean]
Example:
$ gen-api-models --api-spec ./api/public_api_v1.yaml --out-dir ./lib/api/definitions --ts-spec-file ./lib/api/public_api_v1.ts
Writing TS Specs to lib/api/public_api_v1.ts
ProblemJson -> lib/api/definitions/ProblemJson.ts
NotificationChannel -> lib/api/definitions/NotificationChannel.ts
NotificationChannelStatusValue -> lib/api/definitions/NotificationChannelStatusValue.ts
...
done
The http client is defined in client.ts module file. It exports the following:
Client<K> which define the set of operationsK a union of keys that represent the parameters omitted by the operations (see withDefaults below)createClient<K>(parameters): Client<K> accepting the following parameters:baseUrl the base hostname of the api, including protocol and portfetchApi an implementation of the fetch-api as defined in your platform (for example: node-fetch if you are in node)basePath (optional) if defined, is appended to baseUrl for every operations. Its default is the basePath value defined in the specificationwithDefaults (optional) an adapter function that wraps every operations. It may shadow some parameters to the wrapped operations. The use case is: you have a parameter which is common to many operations and you want it to be fixed (example: a session token).WithDefaultsT<K> that defines an adapter function to be used as withDefaultsK the set of parameters that the adapter will shadowimport { createClient, WithDefaultsT } from "my-api/client";
// Without withDefaults
const simpleClient: Client = createClient({
baseUrl: `http://localhost:8080`,
fetchApi: (nodeFetch as any) as typeof fetch
});
// myOperation is defined to accept { id: string; Bearer: string; }
const result = await simpleClient.myOperation({
id: "id123",
Bearer: "VALID_TOKEN"
});
// with withDefaults
const withBearer: WithDefaultsT<"Bearer"> =
wrappedOperation =>
params => { // wrappedOperation and params are correctly inferred
return wrappedOperation({
...params,
Bearer: "VALID_TOKEN"
});
};
// this is the same of using createClient<"Bearer">. K type is being inferred from withBearer
const clientWithGlobalToken: Client<"Bearer"> = createClient({
baseUrl: `http://localhost:8080`,
fetchApi: (nodeFetch as any) as typeof fetch,
withDefaults: withBearer
});
// myOperation doesn't require "Bearer" anymore, as it's defined in "withBearer" adapter
const result = await clientWithGlobalToken.myOperation({
id: "id123"
});
Bundles a generated api models and clients into a node package ready to be published into a registry.
The script is expected to be executed in the root of an application exposing an API, thus it infers package attributes from the expected ./package.json file. Values can be still overridden by provinding the respective CLI argument. To avoid this behavior, use --no-infer-attrs or -N.
$ gen-api-sdk --help
Package options:
--no-infer-attr, -N Infer package attributes from a
package.json file present in the current
directory [boolean] [default: false]
--package-name, -n, --name Name of the generated package [string]
--package-version, -V Version of the generated package [string]
--package-description, -d, --desc Description of the package [string]
--package-author, -a, --author The author of the API exposed [string]
--package-license, -L, --license The license of the API Exposed [string]
--package-registry, -r, --registry Url of the registry the package is
published in [string]
--package-access, -x, --access Either 'public' or 'private', depending of
the accessibility of the package in the
registry
[string] [choices: "public", "private"]
Code generation options:
--api-spec, -i Path to input OpenAPI spec file [string] [required]
--strict Generate strict interfaces (default: true)
[default: true]
--out-dir, -o Output directory to store generated definition files
[string] [required]
--default-success-type Default type for success responses (experimental,
default: 'undefined') [string] [default: "undefined"]
--default-error-type Default type for error responses (experimental,
default: 'undefined') [string] [default: "undefined"]
--camel-cased Generate camelCased properties name (default: false)
[default: false]
Options:
--version Show version number [boolean]
--help Show help [boolean]
Takes a given api spec file and resolves its esternal references by creating a new file with only internal refereces
$ bundle-api-spec --help
Code generation options:
--api-spec, -i Path to input OpenAPI spec file [string] [required]
--out-path, -o Output path of the spec file [string] [required]
--api-version, -V Version of the api. If provided, override the version in
the original spec file [string]
Options:
--version Show version number [boolean]
--help Show help [boolean]
node version >= 10.8.0Run test over utils' implementation
yarn test
Run test over generated files
yarn e2e
When using gen-api-models against a specification file which references an external definition file, some of such remote definitions do not result in a dedicated model file. This is somehow intended and the rationale is explained here. Quick takeaway is that to have a definition to result in a model file, it must be explicitly referenced by the specification file.
In short: if you need to keep the references between the generated classes, the specification file must contain all the schema definitions. See example below.
if the Pets schema uses the Pet, import both into the main document
components:
schemas:
Pets:
$ref: "animal.yaml#/Pets"
Pet:
$ref: "animal.yaml#/Pet"
animal.yaml
Pets:
type: array
items:
$ref: '#/definitions/Pet'
Pet:
type: "object"
required:
- name
properties:
name:
type: string
Generated code is slightly different from v4 as it implements some bug fixes that result in breaking changes. Here's a list of what to be aware of:
name field in the spec. This applies to both local and global parameters. In the previous version, this used to be true only for local ones, while global parameters were named after the parameter's definition name.in: header, the definition name is considered, as the name attribute refers to the actual header name to be used as for OpenApi specification.gen-api-models command, --request-types flag must be used explicitly in order to have requestTypes file generated.name attribute as the parameter name. It used to be the lower-cased reference's name instead.mkdir anymore.WithinRangeInteger or WithinRangeNumber. See [#205].FAQs
Tools and utilities for the IO project
We found that italia-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
November CVE publications fell 25% YoY even as 2025 totals rose, showing how a few major CNAs can swing “global” counts and skew perceived risk.

Security News
React disclosed a CVSS 10.0 RCE in React Server Components and is advising users to upgrade affected packages and frameworks to patched versions now.

Research
/Security News
We spotted a wave of auto-generated “elf-*” npm packages published every two minutes from new accounts, with simple malware variants and early takedowns underway.