Commit 370a637
committed
build(roxygen): force kin-openapi to the patched 0.144.0
Six open advisories, two of them critical, all against the same indirect
dependency of oapi-codegen. None of them reach anyone using this SDK:
kin-openapi is absent from the published module graph entirely, so a
consumer running go get never downloads it, and the vulnerabilities are
in openapi3filter, a server-side request validator that a code generator
does not run.
oapi-codegen v2.8.0 is the newest release and still pins 0.142.0, so
there is nothing to upgrade to; the explicit require is what moves it.
Generated output is byte-identical after the bump, which is the check
that mattered.
go.work.sum is ignored rather than committed: it resolves against
whatever modules happen to be checked out locally.1 parent 85d18f8 commit 370a637
3 files changed
Lines changed: 6 additions & 3 deletions
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
16 | 16 | | |
17 | 17 | | |
18 | 18 | | |
| 19 | + | |
| 20 | + | |
| 21 | + | |
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
6 | 6 | | |
7 | 7 | | |
8 | 8 | | |
9 | | - | |
| 9 | + | |
10 | 10 | | |
11 | 11 | | |
12 | 12 | | |
| |||
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
13 | 13 | | |
14 | 14 | | |
15 | 15 | | |
16 | | - | |
17 | | - | |
| 16 | + | |
| 17 | + | |
18 | 18 | | |
19 | 19 | | |
20 | 20 | | |
| |||
0 commit comments