fix: prevent panic when text value sent to FormFile field

huma.go

@@ -795,6 +795,11 @@ func Register[I, O any](api API, op Operation, handler func(context.Context, *I)
 									return
 								}
 
+								// Skip FormFile and []FormFile fields - they are handled separately
+								if p.Type == reflect.TypeOf(FormFile{}) || p.Type == reflect.TypeOf([]FormFile{}) {
+									return
+								}
+
 								pb.Reset()
 								pb.Push(p.Loc)
 								pb.Push(p.Name)

huma_test.go

@@ -1405,6 +1405,67 @@ Hello, World!
 				assert.Equal(t, http.StatusUnprocessableEntity, resp.Code)
 			},
 		},
+		{
+			Name: "request-body-multipart-file-decoded-text-value-sent-to-file-field",
+			Register: func(t *testing.T, api huma.API) {
+				huma.Register(api, huma.Operation{
+					Method: http.MethodPost,
+					Path:   "/upload",
+				}, func(ctx context.Context, input *struct {
+					RawBody huma.MultipartFormFiles[struct {
+						Avatar huma.FormFile `form:"avatar" contentType:"image/jpeg, image/png" required:"true"`
+					}]
+				}) (*struct{}, error) {
+					return nil, nil
+				})
+			},
+			Method:  http.MethodPost,
+			URL:     "/upload",
+			Headers: map[string]string{"Content-Type": "multipart/form-data; boundary=SimpleBoundary"},
+			Body: `--SimpleBoundary
+Content-Disposition: form-data; name="avatar"
+
+test
+--SimpleBoundary--`,
+			Assert: func(t *testing.T, resp *httptest.ResponseRecorder) {
+				// Should return validation error, not panic
+				var errors huma.ErrorModel
+				err := json.Unmarshal(resp.Body.Bytes(), &errors)
+				require.NoError(t, err)
+				assert.Equal(t, "File required", errors.Errors[0].Message)
+				assert.Equal(t, "avatar", errors.Errors[0].Location)
+				assert.Equal(t, http.StatusUnprocessableEntity, resp.Code)
+			},
+		},
+		{
+			Name: "request-body-multipart-file-decoded-text-value-sent-to-optional-file-field",
+			Register: func(t *testing.T, api huma.API) {
+				huma.Register(api, huma.Operation{
+					Method: http.MethodPost,
+					Path:   "/upload",
+				}, func(ctx context.Context, input *struct {
+					RawBody huma.MultipartFormFiles[struct {
+						Avatar huma.FormFile `form:"avatar" contentType:"image/jpeg, image/png"`
+					}]
+				}) (*struct{}, error) {
+					// Field should be empty, not panic
+					assert.False(t, input.RawBody.Data().Avatar.IsSet)
+					return nil, nil
+				})
+			},
+			Method:  http.MethodPost,
+			URL:     "/upload",
+			Headers: map[string]string{"Content-Type": "multipart/form-data; boundary=SimpleBoundary"},
+			Body: `--SimpleBoundary
+Content-Disposition: form-data; name="avatar"
+
+test
+--SimpleBoundary--`,
+			Assert: func(t *testing.T, resp *httptest.ResponseRecorder) {
+				// Should succeed - optional field just stays empty (returns 204 No Content)
+				assert.Equal(t, http.StatusNoContent, resp.Code)
+			},
+		},
 		{
 			Name: "request-body-multipart-file-decoded-content-type-default",
 			Register: func(t *testing.T, api huma.API) {

humacli/humacli.go

@@ -393,7 +393,7 @@ func (c *cli[O]) setupOptions(t reflect.Type, path []int, prefix string) error {
 //	// First, define your input options.
 //	type Options struct {
 //		Debug bool   `doc:"Enable debug logging"`
-//		Host  string `doc:"Hostname to listen on."`
+//		Host  string `doc:"ServerURL to listen on."`
 //		Port  int    `doc:"Port to listen on." short:"p" default:"8888"`
 //	}
 //

humacli/humacli_test.go

@@ -21,7 +21,7 @@ func ExampleCLI() {
 	// First, define your input options.
 	type Options struct {
 		Debug bool   `doc:"Enable debug logging"`
-		Host  string `doc:"Hostname to listen on."`
+		Host  string `doc:"ServerURL to listen on."`
 		Port  int    `doc:"Port to listen on." short:"p" default:"8888"`
 	}
 
@@ -120,7 +120,7 @@ func TestCLIAdvanced(t *testing.T) {
 	type Options struct {
 		// Example of option composition via embedded type.
 		DebugOption
-		Host    string        `doc:"Hostname to listen on."`
+		Host    string        `doc:"ServerURL to listen on."`
 		Port    *int          `doc:"Port to listen on." short:"p" default:"8000"`
 		Timeout time.Duration `doc:"Request timeout." default:"5s"`
 	}