NSWAG does not generate (C#) data-annotations for URL parameters

[GeneralGorgonzola]

This is a simplified OpenAPI spec to illustrate the problem.

openapi: 3.0.1
info:
  title: FirmwareService
  version: '1.0'
paths:
  /api/Firmware/{deviceType}:
    get:
      tags:
        - Firmware
      operationId: getFirmware
      description: Get firmware.
      parameters:
        - name: deviceType
          in: path
          required: true
          schema:
            type: string
            pattern: ^[a-zA-Z0-9]*$
        - name: version
          in: query
          required: false
          schema:
            type: string
            pattern: ^[a-zA-Z0-9.]*$
      responses:
        '200':
          description: Success
          headers:
            Transfer-Encoding:
              schema:
                type: string
                format: binary
              description: chunked
          content:
            application/octet-stream:
              schema: {}

It is supposed to constrain the URL parameters (query + path) to a certain max-length and to disallow certain characters.

This works if you paste the YAML into https://editor.swagger.io/ and try it out there.

The settings-json (nswag.json) contains:

    "openApiToCSharpController": {
      "controllerBaseClass": null,
      "controllerStyle": "Partial",
      "controllerTarget": "AspNetCore",
      "useCancellationToken": true,
      "useActionResultType": true,
      "generateModelValidationAttributes": false,
      "routeNamingStrategy": "None",
      "basePath": null,
      "className": "$(Output)",
      "operationGenerationMode": "MultipleClientsFromOperationId",
      "additionalNamespaceUsages": [],
      "additionalContractNamespaceUsages": [],
      "generateOptionalParameters": false,
      "generateJsonMethods": false,
      "enforceFlagEnums": false,
      "parameterArrayType": "System.Collections.Generic.IEnumerable",
      "parameterDictionaryType": "System.Collections.Generic.IDictionary",
      "responseArrayType": "System.Collections.Generic.ICollection",
      "responseDictionaryType": "System.Collections.Generic.IDictionary",
      "wrapResponses": false,
      "wrapResponseMethods": [],
      "generateResponseClasses": false,
      "responseClass": "SwaggerResponse",
      "namespace": "$(Output)",
      "requiredPropertiesMustBeDefined": true,
      "dateType": "System.DateTimeOffset",
      "jsonConverters": null,
      "anyType": "object",
      "dateTimeType": "System.DateTimeOffset",
      "timeType": "System.TimeSpan",
      "timeSpanType": "System.TimeSpan",
      "arrayType": "System.Collections.Generic.List",
      "arrayInstanceType": "System.Collections.Generic.List",
      "dictionaryType": "System.Collections.Generic.IDictionary",
      "dictionaryInstanceType": "System.Collections.Generic.Dictionary",
      "arrayBaseType": "System.Collections.ObjectModel.Collection",
      "dictionaryBaseType": "System.Collections.Generic.Dictionary",
      "classStyle": "Poco",
      "jsonLibrary": "SystemTextJson",
      "generateDefaultValues": true,
      "generateDataAnnotations": true,
      "excludedTypeNames": [],
      "excludedParameterNames": [],
      "handleReferences": false,
      "generateImmutableArrayProperties": false,
      "generateImmutableDictionaryProperties": false,
      "jsonSerializerSettingsTransformationMethod": null,
      "inlineNamedArrays": false,
      "inlineNamedDictionaries": false,
      "inlineNamedTuples": true,
      "inlineNamedAny": false,
      "generateDtoTypes": true,
      "generateOptionalPropertiesAsNullable": false,
      "generateNullableReferenceTypes": false,
      "templateDirectory": null,
      "typeNameGeneratorType": null,
      "propertyNameGeneratorType": null,
      "enumNameGeneratorType": null,
      "serviceHost": null,
      "serviceSchemes": null,
      "output": "generated/$(Output)Controller.cs",
      "newLineBehavior": "Auto"
    }

Generate code: npx --yes nswag run ./nswag.json

The generated C# server-code does not contain any annotations?
It means I can pass in arbitrary strings for those URL parameters.

Am I simply misunderstanding how it works, or missing a setting?