Skip to content

Rebase the expand-extensions patch onto upstream v0.22.9 - #8

Merged
ademidoff merged 57 commits into
masterfrom
percona-expand-extensions-v0.22.9
Aug 3, 2026
Merged

Rebase the expand-extensions patch onto upstream v0.22.9#8
ademidoff merged 57 commits into
masterfrom
percona-expand-extensions-v0.22.9

Conversation

@ademidoff

@ademidoff ademidoff commented Aug 3, 2026

Copy link
Copy Markdown
Member

Rebases the only functional Percona patch in this fork (keep the extensions declared next to a $ref, such as x-order, on the expanded schema) onto upstream v0.22.9.

Why

The previous fork base predates spec.ExpandSchemaWithOptions and spec.ExpandOptions.PathLoaderWithOptions, which go-openapi/analysis v0.25.5 requires. Anything pulling go-openapi/runtime v0.33.0 or go-openapi/validate v0.26.1 therefore fails to compile against this fork — see percona/pmm#5705.

Without the patch, swagger flatten --with-flatten=expand drops x-order from $ref properties, so the order of fields in generated PMM API clients is lost.

Notes

  • Branched off the upstream v0.22.9 tag rather than merged into the old master, so the fork now carries exactly one commit on top of upstream. Future bumps are a re-apply of a single hunk. The Percona-specific CI/lint commits from PMM-14577 are not carried over.
  • Upstream moved the tail of the ref expansion from expandSchema to expandSchemaRef; the patch is applied there.
  • The parameter-level fixture/test tweaks that came with the original 2019 patch are no longer needed (upstream keeps parameter extensions on its own), so they are dropped and replaced by TestExpand_KeepsSiblingExtensions, which covers the schema case directly and fails without the patch.
  • Full upstream test suite passes.

fredbi and others added 30 commits December 19, 2025 12:34
@fredbi
doc: announced new discord channel
e64b092 
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@bot-go-openapi @github-actions
doc: updated contributors file
90efd45 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@fredbi
fix: fixed key escaping in OrderedItems marshaling
3b2ff60 
* fixes go-openapi#216

Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>
@bot-go-openapi @github-actions
doc: updated contributors file
5fc39a0 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group with 7 updates
22037ac 
Bumps the development-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.1.2` | `0.2.3` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.1.2` | `0.2.3` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.1.2` | `0.2.3` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.1.2` | `0.2.3` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.1.2` | `0.2.3` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.1.2` | `0.2.3` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.1.2` | `0.2.3` |


Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.1.2 to 0.2.3
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@9e70984...19440f9)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.1.2 to 0.2.3
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@9e70984...19440f9)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.1.2 to 0.2.3
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@9e70984...19440f9)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.1.2 to 0.2.3
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@9e70984...19440f9)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.1.2 to 0.2.3
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@9e70984...19440f9)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.1.2 to 0.2.3
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@9e70984...19440f9)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.1.2 to 0.2.3
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@9e70984...19440f9)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.2.3
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump github.com/go-openapi/testify/v2
02c28f2 
Bumps the go-openapi-dependencies group with 1 update: [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/v2` from 2.0.2 to 2.1.8
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.0.2...v2.1.8)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.1.8
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group with 7 updates
d181245 
Bumps the development-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.2.3` | `0.2.5` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.3` | `0.2.5` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.2.3` | `0.2.5` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.2.3` | `0.2.5` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.2.3` | `0.2.5` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.2.3` | `0.2.5` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.3` | `0.2.5` |


Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.2.3 to 0.2.5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@19440f9...ea0dfc9)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.2.3 to 0.2.5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@19440f9...ea0dfc9)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.2.3 to 0.2.5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@19440f9...ea0dfc9)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.2.3 to 0.2.5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@19440f9...ea0dfc9)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.2.3 to 0.2.5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@19440f9...ea0dfc9)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.2.3 to 0.2.5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@19440f9...ea0dfc9)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.2.3 to 0.2.5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@19440f9...ea0dfc9)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.2.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump github.com/go-openapi/testify/v2
d708159 
Bumps the go-openapi-dependencies group with 1 update: [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/v2` from 2.1.8 to 2.2.0
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.1.8...v2.2.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.2.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump github.com/go-openapi/testify/v2
71eebab 
Bumps the go-openapi-dependencies group with 1 update: [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/v2` from 2.2.0 to 2.3.0
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.2.0...v2.3.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group with 7 updates
7ca5d97 
Bumps the development-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.2.5` | `0.2.9` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.5` | `0.2.9` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.2.5` | `0.2.9` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.2.5` | `0.2.9` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.2.5` | `0.2.9` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.2.5` | `0.2.9` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.5` | `0.2.9` |


Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.2.5 to 0.2.9
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@ea0dfc9...84f8f9c)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.2.5 to 0.2.9
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@ea0dfc9...84f8f9c)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.2.5 to 0.2.9
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@ea0dfc9...84f8f9c)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.2.5 to 0.2.9
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@ea0dfc9...84f8f9c)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.2.5 to 0.2.9
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@ea0dfc9...84f8f9c)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.2.5 to 0.2.9
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@ea0dfc9...84f8f9c)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.2.5 to 0.2.9
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@ea0dfc9...84f8f9c)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.2.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump github.com/go-openapi/testify/v2
0c2d5d4 
Bumps the go-openapi-dependencies group with 1 update: [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/v2` from 2.3.0 to 2.4.0
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.3.0...v2.4.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@fredbi
chore: doc, tests, lint (go-openapi#255)
d6177ef 
* documentation update to meet go-openapi standards
* fixed discord link
* relinted godoc and markdown

* relinted the codebase (many nolint directives are set, the design
  can't be changed easily)
* simplified test assertions for JSON & YAML (replaced ad'hoc helpers by
  testify/v2 features)
* test: worked around windows-specific data race issue in tests (used
  embed fs to avoid windows FS issues)

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group with 7 updates
fb0c59e 
Bumps the development-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.2.9` | `0.2.11` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.9` | `0.2.11` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.2.9` | `0.2.11` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.2.9` | `0.2.11` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.2.9` | `0.2.11` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.2.9` | `0.2.11` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.9` | `0.2.11` |


Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.2.9 to 0.2.11
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@84f8f9c...435746a)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.2.9 to 0.2.11
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@84f8f9c...435746a)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.2.9 to 0.2.11
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@84f8f9c...435746a)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.2.9 to 0.2.11
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@84f8f9c...435746a)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.2.9 to 0.2.11
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@84f8f9c...435746a)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.2.9 to 0.2.11
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@84f8f9c...435746a)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.2.9 to 0.2.11
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@84f8f9c...435746a)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.2.11
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@bot-go-openapi @github-actions
doc: updated contributors file
cb33f35 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@dependabot @github-actions
build(deps): bump the go-openapi-dependencies group with 2 updates
6bf1996 
Bumps the go-openapi-dependencies group with 2 updates: [github.com/go-openapi/testify/enable/yaml/v2](https://github.com/go-openapi/testify) and [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/enable/yaml/v2` from 2.4.0 to 2.4.1
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.4.0...v2.4.1)

Updates `github.com/go-openapi/testify/v2` from 2.4.0 to 2.4.1
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.4.0...v2.4.1)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/enable/yaml/v2
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.4.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@fredbi
doc: update discord link (go-openapi#260)
b2867e8
@fredbi @claude
doc: add portable agentic instructions (go-openapi#261)
b7c0c19 
* doc: add portable agentic instructions

Add copilot-instructions.md, AGENTS.md (symlink), .github/copilot
symlink to .claude/rules, contributions and workflows rules.
Rewrite CLAUDE.md with accurate package documentation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

* doc: include previously ignored rule files

Add linting.md and testing.md rules that were hidden by the old
.gitignore pattern.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>

---------

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@fredbi @claude
chore: bump go directive to 1.25.0 (go-openapi#262)
1505803 
Update all go.mod (and go.work where applicable) to require go 1.25.0.

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group with 7 updates
2e5142b 
Bumps the development-dependencies group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.2.11` | `0.2.15` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.11` | `0.2.15` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.2.11` | `0.2.15` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.2.11` | `0.2.15` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.2.11` | `0.2.15` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.2.11` | `0.2.15` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.11` | `0.2.15` |


Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.2.11 to 0.2.15
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@435746a...e8e6599)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.2.11 to 0.2.15
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@435746a...e8e6599)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.2.11 to 0.2.15
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@435746a...e8e6599)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.2.11 to 0.2.15
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@435746a...e8e6599)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.2.11 to 0.2.15
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@435746a...e8e6599)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.2.11 to 0.2.15
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@435746a...e8e6599)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.2.11 to 0.2.15
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@435746a...e8e6599)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.2.15
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump the go-openapi-dependencies group with 2 updates
2b49290 
Bumps the go-openapi-dependencies group with 2 updates: [github.com/go-openapi/testify/enable/yaml/v2](https://github.com/go-openapi/testify) and [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/enable/yaml/v2` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.4.1...v2.4.2)

Updates `github.com/go-openapi/testify/v2` from 2.4.1 to 2.4.2
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.4.1...v2.4.2)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/enable/yaml/v2
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.4.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@bot-go-openapi @github-actions
doc: updated contributors file
c5c7103 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@dependabot @github-actions
build(deps): bump the go-openapi-dependencies group with 6 updates
1d7d651 
Bumps the go-openapi-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) | `0.22.5` | `0.23.0` |
| [github.com/go-openapi/swag/conv](https://github.com/go-openapi/swag) | `0.25.5` | `0.26.0` |
| [github.com/go-openapi/swag/jsonname](https://github.com/go-openapi/swag) | `0.25.5` | `0.26.0` |
| [github.com/go-openapi/swag/jsonutils](https://github.com/go-openapi/swag) | `0.25.5` | `0.26.0` |
| [github.com/go-openapi/swag/loading](https://github.com/go-openapi/swag) | `0.25.5` | `0.26.0` |
| [github.com/go-openapi/swag/stringutils](https://github.com/go-openapi/swag) | `0.25.5` | `0.26.0` |


Updates `github.com/go-openapi/jsonpointer` from 0.22.5 to 0.23.0
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](go-openapi/jsonpointer@v0.22.5...v0.23.0)

Updates `github.com/go-openapi/swag/conv` from 0.25.5 to 0.26.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.5...v0.26.0)

Updates `github.com/go-openapi/swag/jsonname` from 0.25.5 to 0.26.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.5...v0.26.0)

Updates `github.com/go-openapi/swag/jsonutils` from 0.25.5 to 0.26.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.5...v0.26.0)

Updates `github.com/go-openapi/swag/loading` from 0.25.5 to 0.26.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.5...v0.26.0)

Updates `github.com/go-openapi/swag/stringutils` from 0.25.5 to 0.26.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.25.5...v0.26.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 0.23.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/conv
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/jsonname
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/jsonutils
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/loading
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/stringutils
  dependency-version: 0.26.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump github.com/go-openapi/jsonpointer
a2d9c41 
Bumps the go-openapi-dependencies group with 1 update: [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer).


Updates `github.com/go-openapi/jsonpointer` from 0.23.0 to 0.23.1
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](go-openapi/jsonpointer@v0.23.0...v0.23.1)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 0.23.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump the go-openapi-dependencies group with 2 updates
a5d0895 
Bumps the go-openapi-dependencies group with 2 updates: [github.com/go-openapi/testify/enable/yaml/v2](https://github.com/go-openapi/testify) and [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/enable/yaml/v2` from 2.4.2 to 2.5.0
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.4.2...v2.5.0)

Updates `github.com/go-openapi/testify/v2` from 2.4.2 to 2.5.0
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.4.2...v2.5.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/enable/yaml/v2
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.5.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group across 1 directo…
596087b 
…ry with 7 updates

Bumps the development-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.2.15` | `0.2.16` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.15` | `0.2.16` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.2.15` | `0.2.16` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.2.15` | `0.2.16` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.2.15` | `0.2.16` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.2.15` | `0.2.16` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.15` | `0.2.16` |



Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.2.15 to 0.2.16
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@e8e6599...6ed4490)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.2.15 to 0.2.16
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@e8e6599...6ed4490)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.2.15 to 0.2.16
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@e8e6599...6ed4490)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.2.15 to 0.2.16
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@e8e6599...6ed4490)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.2.15 to 0.2.16
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@e8e6599...6ed4490)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.2.15 to 0.2.16
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@e8e6599...6ed4490)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.2.15 to 0.2.16
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@e8e6599...6ed4490)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.2.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump the go-openapi-dependencies group with 2 updates
5c73b50 
Bumps the go-openapi-dependencies group with 2 updates: [github.com/go-openapi/testify/enable/yaml/v2](https://github.com/go-openapi/testify) and [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/enable/yaml/v2` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.5.0...v2.5.1)

Updates `github.com/go-openapi/testify/v2` from 2.5.0 to 2.5.1
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.5.0...v2.5.1)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/enable/yaml/v2
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.5.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group across 1 directo…
9715006 
…ry with 7 updates

Bumps the development-dependencies group with 7 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.2.16` | `0.2.17` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.16` | `0.2.17` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.2.16` | `0.2.17` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.2.16` | `0.2.17` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.2.16` | `0.2.17` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.2.16` | `0.2.17` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.16` | `0.2.17` |



Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@6ed4490...7982843)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@6ed4490...7982843)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@6ed4490...7982843)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@6ed4490...7982843)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@6ed4490...7982843)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@6ed4490...7982843)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.2.16 to 0.2.17
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@6ed4490...7982843)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.2.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@fredbi
feat(ci): added shared workflow for bot-pr monitoring
45b7fe1 
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@dependabot @github-actions
build(deps): bump the development-dependencies group with 8 updates
0741160 
Bumps the development-dependencies group with 8 updates:

| Package | From | To |
| --- | --- | --- |
| [go-openapi/ci-workflows/.github/workflows/auto-merge.yml](https://github.com/go-openapi/ci-workflows) | `0.2.17` | `0.3.4` |
| [go-openapi/ci-workflows/.github/workflows/bump-release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.17` | `0.3.4` |
| [go-openapi/ci-workflows/.github/workflows/codeql.yml](https://github.com/go-openapi/ci-workflows) | `0.2.17` | `0.3.4` |
| [go-openapi/ci-workflows/.github/workflows/contributors.yml](https://github.com/go-openapi/ci-workflows) | `0.2.17` | `0.3.4` |
| [go-openapi/ci-workflows/.github/workflows/go-test.yml](https://github.com/go-openapi/ci-workflows) | `0.2.17` | `0.3.4` |
| [go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml](https://github.com/go-openapi/ci-workflows) | `980b99d60c7d219dbc51f63a7e401c651586b680` | `cd9849915b4f8b6ceeeaf24e02e8f8e24202c8f6` |
| [go-openapi/ci-workflows/.github/workflows/scanner.yml](https://github.com/go-openapi/ci-workflows) | `0.2.17` | `0.3.4` |
| [go-openapi/ci-workflows/.github/workflows/release.yml](https://github.com/go-openapi/ci-workflows) | `0.2.17` | `0.3.4` |


Updates `go-openapi/ci-workflows/.github/workflows/auto-merge.yml` from 0.2.17 to 0.3.4
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@7982843...7a1bb6c)

Updates `go-openapi/ci-workflows/.github/workflows/bump-release.yml` from 0.2.17 to 0.3.4
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@7982843...7a1bb6c)

Updates `go-openapi/ci-workflows/.github/workflows/codeql.yml` from 0.2.17 to 0.3.4
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@7982843...7a1bb6c)

Updates `go-openapi/ci-workflows/.github/workflows/contributors.yml` from 0.2.17 to 0.3.4
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@7982843...7a1bb6c)

Updates `go-openapi/ci-workflows/.github/workflows/go-test.yml` from 0.2.17 to 0.3.4
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@7982843...7a1bb6c)

Updates `go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml` from 980b99d60c7d219dbc51f63a7e401c651586b680 to cd9849915b4f8b6ceeeaf24e02e8f8e24202c8f6
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@980b99d...cd98499)

Updates `go-openapi/ci-workflows/.github/workflows/scanner.yml` from 0.2.17 to 0.3.4
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@7982843...7a1bb6c)

Updates `go-openapi/ci-workflows/.github/workflows/release.yml` from 0.2.17 to 0.3.4
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@7982843...7a1bb6c)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/auto-merge.yml
  dependency-version: 0.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/bump-release.yml
  dependency-version: 0.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/codeql.yml
  dependency-version: 0.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/contributors.yml
  dependency-version: 0.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/go-test.yml
  dependency-version: 0.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml
  dependency-version: cd9849915b4f8b6ceeeaf24e02e8f8e24202c8f6
  dependency-type: direct:production
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/scanner.yml
  dependency-version: 0.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
- dependency-name: go-openapi/ci-workflows/.github/workflows/release.yml
  dependency-version: 0.3.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@fredbi
doc: aligned with org docs (go-openapi#273)
9a2db11 
Signed-off-by: Frédéric BIDON <fredbi@yahoo.com>
fredbi and others added 23 commits June 14, 2026 14:22
@fredbi
fix(header): header extension should correctly marshal as JSON
e41b4fd 
* fixes go-openapi#277

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi
chore: relint
49846cb 
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi
Merge pull request go-openapi#278 from fredbi/fix/277-header-ext
1b69857 
Fix/277 header ext
@dependabot @github-actions
build(deps): bump go-openapi/ci-workflows/.github/workflows/monitor-b…
dc55c96 
…ot-pr.yml

Bumps the development-dependencies group with 1 update: [go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml](https://github.com/go-openapi/ci-workflows).


Updates `go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml` from 93b16765c4045dbd4dac2372803294298aa7592a to 2e57e83146e049b5dfb8116ba16a09b2da27b3c5
- [Release notes](https://github.com/go-openapi/ci-workflows/releases)
- [Commits](go-openapi/ci-workflows@93b1676...2e57e83)

---
updated-dependencies:
- dependency-name: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml
  dependency-version: 2e57e83146e049b5dfb8116ba16a09b2da27b3c5
  dependency-type: direct:production
  dependency-group: development-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@bot-go-openapi @github-actions
doc: updated contributors file
eb04d47 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@fredbi @claude
chore(ci): run contributors workflow monthly instead of weekly (go-op…
1754e05 
…enapi#281)

The all-time contributors workflow no longer needs a weekly cadence:
nowadays it mostly bumps maintainer activity. Run it on the 1st of
each month at 04:49 UTC ('49 4 1 * *') instead of every Saturday.

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@fredbi @claude
ci: post README announcements to discord + bump ci-workflows to v0.4.0 (
da6a6cf 
go-openapi#282)

Add the webhook-announcements workflow (mirrors go-openapi/testify): pushes
to master that change README.md are scanned for new "## Announcements"
entries and posted to the discord channel.
Also bump all ci-workflows shared-workflow pins to v0.4.0
(af4c93f45481ea7d24ac2a9858272cc03daf424e).

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@dependabot @github-actions
build(deps): bump the go-openapi-dependencies group with 2 updates
bac1bee 
Bumps the go-openapi-dependencies group with 2 updates: [github.com/go-openapi/testify/enable/yaml/v2](https://github.com/go-openapi/testify) and [github.com/go-openapi/testify/v2](https://github.com/go-openapi/testify).


Updates `github.com/go-openapi/testify/enable/yaml/v2` from 2.5.1 to 2.6.0
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.5.1...v2.6.0)

Updates `github.com/go-openapi/testify/v2` from 2.5.1 to 2.6.0
- [Release notes](https://github.com/go-openapi/testify/releases)
- [Commits](go-openapi/testify@v2.5.1...v2.6.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/testify/enable/yaml/v2
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/testify/v2
  dependency-version: 2.6.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@bot-go-openapi @github-actions
doc: updated contributors file
8e7a0e6 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
@dependabot @github-actions
build(deps): bump the go-openapi-dependencies group with 6 updates
9b21ccd 
Bumps the go-openapi-dependencies group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) | `0.23.1` | `0.24.0` |
| [github.com/go-openapi/swag/conv](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |
| [github.com/go-openapi/swag/jsonname](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |
| [github.com/go-openapi/swag/jsonutils](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |
| [github.com/go-openapi/swag/loading](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |
| [github.com/go-openapi/swag/stringutils](https://github.com/go-openapi/swag) | `0.26.1` | `0.27.0` |


Updates `github.com/go-openapi/jsonpointer` from 0.23.1 to 0.24.0
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](go-openapi/jsonpointer@v0.23.1...v0.24.0)

Updates `github.com/go-openapi/swag/conv` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

Updates `github.com/go-openapi/swag/jsonname` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

Updates `github.com/go-openapi/swag/jsonutils` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

Updates `github.com/go-openapi/swag/loading` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

Updates `github.com/go-openapi/swag/stringutils` from 0.26.1 to 0.27.0
- [Release notes](https://github.com/go-openapi/swag/releases)
- [Commits](go-openapi/swag@v0.26.1...v0.27.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 0.24.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/conv
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/jsonname
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/jsonutils
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/loading
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/swag/stringutils
  dependency-version: 0.27.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
build(deps): bump the go-openapi-dependencies group with 2 updates (g…
1688f14 
…o-openapi#286)

Bumps the go-openapi-dependencies group with 2 updates: [github.com/go-openapi/jsonpointer](https://github.com/go-openapi/jsonpointer) and [github.com/go-openapi/jsonreference](https://github.com/go-openapi/jsonreference).


Updates `github.com/go-openapi/jsonpointer` from 0.24.0 to 1.0.0
- [Release notes](https://github.com/go-openapi/jsonpointer/releases)
- [Commits](go-openapi/jsonpointer@v0.24.0...v1.0.0)

Updates `github.com/go-openapi/jsonreference` from 0.21.6 to 1.0.0
- [Release notes](https://github.com/go-openapi/jsonreference/releases)
- [Commits](go-openapi/jsonreference@v0.21.6...v1.0.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/jsonpointer
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: go-openapi-dependencies
- dependency-name: github.com/go-openapi/jsonreference
  dependency-version: 1.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: go-openapi-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@fredbi @claude
fix(expander): cap $ref expansion node count to prevent amplification…
d76a1a4 
… DoS

ExpandSpec/ExpandSchema* inline every $ref with no memoization and no global
budget. A self-contained spec where each of N definitions references the next
one twice (via allOf/anyOf/oneOf/properties/items) drives 2^N schema expansions
from O(N) bytes of input. A ~1.5 KB document expands into tens of GB of heap and
>30 s of CPU, letting an unauthenticated caller exhaust resources in any service
that expands untrusted specs. All refs can be fragment-only, so a restrictive
PathLoader is not a mitigation.

The expanded output itself is exponential (expansion inlines by value), so a
memoization cache would bound CPU but not memory. The only guard that bounds
memory is refusing to build the tree past a budget.

Add ExpandOptions.MaxExpansionNodes, a per-call cap on the number of expanded
schema nodes, enforced by a counter in the shared resolverContext incremented at
the top of expandSchema:

  0  (zero value): DefaultMaxExpansionNodes (500,000) -- every caller protected
  <0: unbounded (trusted specs only)
  >0: explicit cap

500,000 leaves ~10x headroom over the largest real spec we test (the full
Kubernetes API expands to ~47,000 nodes) while stopping the attack well before it
hurts. The metric is nodes, not $ref resolutions: measurement showed resolution
counts do not grow with the attack (document-level caching collapses them), so a
resolution cap would miss the blow-up entirely.

Exceeding the budget returns ErrExpandTooManyNodes. This is a resource-exhaustion
safeguard, so it is terminal even under ContinueOnError, rather than leaving the
caller with a silently truncated spec.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi
chore: upgrade dependencies ; fix deprecated jsonname
5ae1e0d 
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi @claude
feat(expander): accept an option-aware document loader
64655f3 
Add ExpandOptions.PathLoaderWithOptions, a document loader matching the
func(string, ...loading.Option) (json.RawMessage, error) signature now used by
the go-openapi/swag/loading and go-openapi/loads loaders. When set, it takes
precedence over PathLoader, which in turn precedes the package-level default.

This lets a caller inject an options-aware loader -- for example one confined
to a directory with loading.WithRoot to safely resolve $ref targets from an
untrusted spec -- directly, without wrapping it in a func(string) adapter
closure. The injected loader carries its own loading options; the expander
invokes it without adding any, keeping the plumbing free of forwarding logic.

The change is additive: existing callers using PathLoader (or the default) are
unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi @claude
fix(ref): stop performing a network request in IsValidURI
4e073e1 
IsValidURI resolved an absolute-URL $ref by issuing http.Get(v) on
http.DefaultClient, which has no timeout and no cancellation. On an
attacker-controlled URL whose server accepts the connection but never responds,
the call blocks indefinitely, leaking goroutines, sockets, and file descriptors.
Because go-openapi/validate calls IsValidURI on every $ref of a spec (in
validateReferencesValid), an untrusted document full of stalling full-URL refs
can exhaust resources during validation (CWE-400/CWE-770). The bare GET to an
arbitrary, caller-supplied URL is also an SSRF vector against internal
addresses.

A method named IsValidURI should validate the reference, not probe remote
reachability over the network: that made validation depend on network
availability and non-deterministic. Resolving and fetching remote references is
the expander's job, through its configurable (and now confinable) document
loader.

Treat a well-formed absolute URL as a valid URI without any network request.
Local file references are still checked on disk. No spec or validate test
depended on the probe (validate's fixtures use fragment-only refs).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi @claude
docs(security): warn that the default $ref loader is not sandboxed
7229152 
Expanding or resolving a specification loads referenced documents through a
pluggable loader that, by default, is unconfined. A "$ref" in an untrusted spec
can therefore read local files ("file:///etc/passwd", "../../secret.json" —
arbitrary file read / path traversal) or reach internal addresses via a remote
"$ref" (SSRF). This is inherent to the default configuration; it is not fixed by
a code change but by using a confined loader.

The mitigation already exists: inject an option-aware loader via
ExpandOptions.PathLoaderWithOptions built with go-openapi/swag/loading options
(loading.WithRoot to confine local reads, loading.WithHTTPClient to restrict
remote fetches), or — recommended — use the restricted loaders from
go-openapi/loads (SpecRestricted / SetRestrictedLoaders), which confine local
reads and reject loopback/private/link-local remote addresses, and whose
confinement applies to every "$ref" resolved during expansion.

Document this in a package-level "Security" section and add pointers to it from
ExpandSpec, ExpandSchemaWithBasePath and ExpandOptions. Also cross-reference
ExpandOptions.MaxExpansionNodes for the related $ref amplification vector.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi @claude
build(deps): bump swag/loading to v0.27.2 for confined $ref loading
75e4859 
swag/loading v0.27.2 makes loading.WithRoot resolve absolute in-root paths
(rebasing them onto the root) instead of rejecting every absolute path. Because
spec normalizes every $ref to an absolute path against the spec's base, this is
what makes a WithRoot-confined loader usable to safely expand an untrusted spec:
legitimate in-root references resolve, while file:// and ../ references that
escape the root are rejected.

Add a consumer-side test that expands an untrusted spec through a
PathLoaderWithOptions loader bound to loading.WithRoot, with an absolute
RelativeBase: it asserts the in-root reference expands, the escaping references
stay unexpanded, and no byte of the out-of-root file leaks into the result.

go mod tidy also drops the now-unused swag/jsonname dependency.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi @claude
test(expander): validate the SSRF posture of an injected loader
fe9f8bd 
Expanding a spec with the default loader fetches any remote "$ref" through
http.DefaultClient with no address filtering, so a "$ref" to a cloud metadata
endpoint (e.g. AWS IMDS at 169.254.169.254), a private address, or localhost is
an SSRF vector. This is documented in the package "Security" section; the
mitigation is to inject an option-aware loader bound to a restricted HTTP
client via ExpandOptions.PathLoaderWithOptions (or use the restricted loaders
from go-openapi/loads).

Add a regression test proving that posture end to end: a loader bound to a
client whose DialContext refuses loopback/private/link-local/unspecified
addresses causes ExpandSpec to refuse the IMDS reference at dial time, before
any connection is made. The loader selection is shared by every expansion and
resolution entry point, so this covers ExpandSpec, ExpandSchemaWithBasePath,
ExpandResponse, ExpandParameter and the Resolve* functions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi @claude
build(deps): bump swag modules to v0.27.3
497d583 
Supersedes the v0.27.2 bump. swag/loading v0.27.3 fixes WithRoot on Windows:
spec normalizes references to a file-URL path form ("/C:/dir/file"), which
v0.27.2 did not recognize as absolute, so os.Root rejected legitimate in-root
targets and TestExpand_ConfinedLoader failed on Windows CI. v0.27.3 normalizes
that form before confinement, so a WithRoot-confined loader resolves in-root
references on Windows too, while still rejecting file:// and ../ escapes.

All go-openapi/swag submodules are moved to v0.27.3 together (stringutils, which
had no v0.27.2 tag, is included). No spec code change is required.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
@fredbi
Merge pull request go-openapi#290 from fredbi/fix/vuln-reports
5173965 
Fix/vuln reports
@fredbi @claude
feat(expander): add ExpandSchemaWithOptions for confined schema expan…
9bfe732 
…sion (go-openapi#291)

ExpandSchema expands a schema against an in-memory root but takes no
ExpandOptions, so it always uses the package default (unsandboxed) document
loader. Downstream consumers that expand a schema whose $ref may come from an
untrusted source — go-openapi/analysis (schema analysis, flatten) and
go-openapi/validate — had no way to inject a confined loader on this path, and
could not reassemble the equivalent themselves because the root-to-base priming
(baseForRoot / normalizeBase) is unexported.

Add ExpandSchemaWithOptions(schema, root, cache, opts): the option-aware form of
ExpandSchema. It preserves the in-memory-root behavior (base derived from root,
schemas always expanded) while honoring the caller's options — in particular
PathLoaderWithOptions / PathLoader for a confined loader, plus ContinueOnError,
AbsoluteCircularRef and MaxExpansionNodes. ExpandSchema is reimplemented as
ExpandSchemaWithOptions(schema, root, cache, nil), so its behavior is unchanged.

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@fredbi @claude
feat(expander): add ExpandParameterWithOptions and ExpandResponseWith…
e682f66 
…Options (go-openapi#292)

ExpandParameter/ExpandParameterWithRoot and ExpandResponse/ExpandResponseWithRoot
expand a parameter or response but take no ExpandOptions, so they always use the
package default (unsandboxed) document loader — the same gap that motivated
ExpandSchemaWithOptions. go-openapi/validate expands every parameter and response
$ref of a spec through these functions, so a $ref from an untrusted source could
not be confined there.

Add ExpandParameterWithOptions(parameter, root, cache, opts) and
ExpandResponseWithOptions(response, root, cache, opts): the option-aware forms.
When root is non-nil, refs resolve against the in-memory root (base derived from
root); otherwise they resolve relative to opts.RelativeBase. In particular
opts.PathLoaderWithOptions / PathLoader inject a confined loader. The four
existing functions are reimplemented in terms of the new ones, so their behavior
is unchanged.

Signed-off-by: Frederic BIDON <fredbi@yahoo.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@ademidoff
Keep extensions data on expand schema
29d6c85 
Re-applies the Percona patch (extensions declared next to a $ref, such as
x-order, are kept on the expanded schema) on top of upstream v0.22.9.

The previous fork base predates spec.ExpandSchemaWithOptions and
spec.ExpandOptions.PathLoaderWithOptions, which go-openapi/analysis v0.25.5
requires, so consumers of go-openapi/runtime v0.33.0 no longer compile
against it.
ademidoff added a commit to percona/pmm that referenced this pull request Aug 3, 2026
@ademidoff
PMM-7 Rebase the go-openapi/spec fork onto upstream v0.22.9
1f6cf6e 
go-openapi/analysis v0.25.5, which runtime v0.33.0 and validate v0.26.1
require, uses spec.ExpandSchemaWithOptions and
spec.ExpandOptions.PathLoaderWithOptions. The previous Percona-Lab/spec base
predates both, so nothing in the repo compiled.

The fork now carries only the extensions-on-expand patch (Percona-Lab/spec#8)
on top of upstream v0.22.9. That patch is still needed: without it,
`swagger flatten --with-flatten=expand` drops x-order from $ref properties and
the field order of the generated API clients is lost.
@ademidoff ademidoff mentioned this pull request Aug 3, 2026
Merged
@ademidoff
ademidoff merged commit f631d6d into master Aug 3, 2026
17 checks passed
@ademidoff
ademidoff deleted the percona-expand-extensions-v0.22.9 branch August 3, 2026 07:51
ademidoff added a commit to percona/pmm that referenced this pull request Aug 3, 2026
@ademidoff
PMM-7 Pin the go-openapi/spec fork to master
9465a22 
Percona-Lab/spec#8 is merged; move the replace from the PR branch commit to
the resulting master merge commit. Same tree, so this is a version-string
change only.
ademidoff added a commit to percona/pmm that referenced this pull request Aug 3, 2026
@dependabot @ademidoff
Chore(deps): Bump github.com/go-openapi/runtime from 0.32.3 to 0.33.0 (…
e69bd96 
…#5705)

* Chore(deps): Bump github.com/go-openapi/runtime from 0.32.3 to 0.33.0

Bumps [github.com/go-openapi/runtime](https://github.com/go-openapi/runtime) from 0.32.3 to 0.33.0.
- [Release notes](https://github.com/go-openapi/runtime/releases)
- [Commits](go-openapi/runtime@v0.32.3...v0.33.0)

---
updated-dependencies:
- dependency-name: github.com/go-openapi/runtime
  dependency-version: 0.33.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* PMM-7 Rebase the go-openapi/spec fork onto upstream v0.22.9

go-openapi/analysis v0.25.5, which runtime v0.33.0 and validate v0.26.1
require, uses spec.ExpandSchemaWithOptions and
spec.ExpandOptions.PathLoaderWithOptions. The previous Percona-Lab/spec base
predates both, so nothing in the repo compiled.

The fork now carries only the extensions-on-expand patch (Percona-Lab/spec#8)
on top of upstream v0.22.9. That patch is still needed: without it,
`swagger flatten --with-flatten=expand` drops x-order from $ref properties and
the field order of the generated API clients is lost.

* PMM-7 Pin the go-openapi/spec fork to master

Percona-Lab/spec#8 is merged; move the replace from the PR branch commit to
the resulting master merge commit. Same tree, so this is a version-string
change only.

* PMM-7 Pin the go-openapi/spec fork to v0.22.9-percona

The fork is now tagged, so the replace can name a version instead of a
pseudo-version that reads as 0.21.0 while the tree matches upstream v0.22.9.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alex Demidoff <a@demidoff.me>
Co-authored-by: Alex Demidoff <alexander.demidoff@percona.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ademidoff @fredbi