Bump kin-openapi to v0.144.0 to fix CVE-2026-73501 (release-0.9 backport)

[ibolton336]

What

Backports #874 (kin-openapi v0.144.0) to the release-0.9 stream (MTA 8.1).

Why

Per the shipped-image build metadata, MTA 8.1 builds mta-cli-rhel9 from migtools/mta-kantra release-0.9. That branch was on kin-openapi v0.108.0 and had not received the CVE-2026-73501 fix (#874 landed on main; #875 backported it to release-0.10 = the 8.2 stream).

CVE-2026-73501 / GHSA-r277-6w6q-xmqw: kin-openapi ≤ 0.143.0 is fail-open in ValidationHandler.Load(). kantra ships the module but does not use that auth path; this removes the vulnerable module regardless.

Changes

• github.com/getkin/kin-openapi v0.108.0 → v0.144.0.
• Port pkg/testing/schema.go to the newer API: schema.Type == "object" → schema.Type.Is("object") (v0.108 used a string Schema.Type; ≥ v0.120 uses *openapi3.Types). 4 call sites.
• go build ./... and go vet ./pkg/testing/... pass. go directive unchanged (v0.144.0 floor is go 1.25, already met).

Trackers (MTA 8.1)

MTA-7603 (CVE-2026-73501).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: b3a6eb37-a1dc-4503-96ef-76489d8e683b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ibolton336]

Closing this release-0.9/8.1 backport.

Rationale: kantra never invokes the vulnerable kin-openapi code path (ValidationHandler.Load / NoopAuthenticationFunc default). It uses only openapi3gen for schema generation, so the fail-open auth bypass is not reachable in the CLI. The module-version bump is posted on main (#874) and delivered to the active release stream via #875 (release-0.10 / MTA 8.2).

Backporting v0.108.0 -> v0.144.0 to release-0.9 crosses the openapi3.Types string -> *openapi3.Types API break, requires porting pkg/testing/schema.go, and regenerates the schema golden (a behavior change) — disproportionate churn on a z-stream for an unexercised path. Tracking MTA-7603 dispositioned as not-affected (vulnerable path not reached).