Bump github.com/oapi-codegen/oapi-codegen/v2 from 2.6.0 to 2.7.1 in /go

[dependabot]

Bumps github.com/oapi-codegen/oapi-codegen/v2 from 2.6.0 to 2.7.1.

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

Security fix for Go code injection

This is a security fix for a code injection vulnerability in v2.7.0, please see:

GHSA-rjwr-m7qx-3fjr

[!NOTE] A vulnerability like this requires that it is missed in code review and that you then call the malicious method.

Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed.

We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.

This is also why we recommend oapi-codegen generated code is committed to source control.

We're more strict about escaping strings passed into the OpenAPI specification, so that people can't inject Go code into generated code.

The problem was that it was possible to craft a description for server URL's which would emit arbitrary Go code, so if an attacker controlled your specification, they could inject Go code into your generated code which could do something malicious.

v2.7.0: Squashing bugs, many bugs (and adding some features)

Many improvements and even more bug fixes

This v2.7.0 release of oapi-codegen contains quite a bit of internal refactoring, focused on our most historically fragile code paths, which relate to the aggregate types (allOf/anyOf/oneOf), $ref to external specs, enums, and the spec traversal logic missing quite a few leaf nodes where models should have been generated, but were skipped.

The biggest changes are explicitly described in the sections below, and the full list of commits is at the bottom.

Thank you to all contributors, we've been going through all past PR's and updating them and merging where we can, and thanks to all our users for reporting issues that you hit.

I've (@​mromaszewicz) used a lot of LLM help here to scrub through old issues and do some deep internal refactoring to address common problem areas. I intend to continue doing this, since the conditional generation logic is getting quite complicated. When I originally released oapi-codegen, the use case was much simpler, all the models were under #/components/schemas, and all the references to them were in the requests, responses, etc. I never imagine how many things would be external references or unions, and how many complex OpenAPI specifications people would be generating code for. The initial design was never flexible enough to handle that, so ongoing bug fixes are getting increasingly complex due to edge cases. This version has a lot of internal changes you won't see as a user, but the way we handle type generation internally is unifying lots of copy/paste re-implementations into reusable code for consistency. Most of these changes can be done transparently, but some can't, so, onto the changes:

Code generation changes which might require some changes on your end

This release contains three changes, all very narrow in scope, which will require some manual adjustment of your own code. We've decided that these are small enough and uncommon enough not to require opt-in, which causes internal complexity. It's always a judgment call with these. If we got it wrong, we're happy to revisit it in a maintenance release.

Strict-server external response refs require strict-server generation in both packages (#2357)

If your strict-server spec uses an external $ref to a components/responses/... defined in another spec, that other spec must also be generated with strict-server: true. Add it to the source spec's config and regenerate:

# config for the spec being $ref'd
generate:
  models: true
  strict-server: true   # now required when imported by a strict-server spec

This restores the v2.0.0 behavior that lets you cast response models across package boundaries — the standard pattern for sharing error models (e.g. a common 400) across services. PR #1387 had silently changed the embedded type from N400JSONResponse to the bare externalRef0.N400, so the local and external response structs no longer had matching types and casts stopped compiling.

Many more anonymous inner schemas are now hoisted into top level schemas

... (truncated)

Commits

• 19c6282 Improve string escaping and add tests (#2396)
• b363ca5 refactor(codegen): better Swagger compression, modern naming (#1909)
• 08b3018 Route server enums through general enums codegen (#2358)
• fbc8e0d revert external-ref carve-out in strict-server response embedding (#2010) (#2...
• 7517e09 respect output file path on gofmt failure (#2356)
• 9643421 fix example codegen (#2354)
• 036a54b per-operation middleware in Echo (#2353)
• 3338f93 Strict server: gate no-content response headers on nullable/optional (#2351)
• 218effe Synchronize strict servers (#2350)
• 81b9d95 Overhaul anonymous schema hoisting (#2348)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

---

Summary by cubic

Upgrade github.com/oapi-codegen/oapi-codegen/v2 from 2.6.0 to 2.7.1 and regenerate Go types to pick up security hardening against Go code injection and recent generator fixes in the /go module.

• Dependencies

  • Bump github.com/oapi-codegen/oapi-codegen/v2 to 2.7.1; regenerate go/pkg/generated types.
  • Refresh indirect deps for compatibility, including github.com/getkin/kin-openapi (0.135.0), github.com/mailru/easyjson (0.9.1), github.com/go-openapi/jsonpointer (0.22.4), github.com/speakeasy-api/openapi (replaces openapi-overlay), github.com/oasdiff/yaml* (0.0.9), golang.org/x/*, plus new github.com/go-openapi/swag/jsonname and go.yaml.in/yaml/v3.

• Migration

  • If regenerating strict-server code with external $ref responses, also generate the referenced specs with strict-server: true.
  • Expect some anonymous inner schemas to be hoisted to top-level; re-run codegen and update any affected type references.
  • Review generated code diffs before execution.

^{Written for commit fa822b3. Summary will update on new commits.}

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates Go module dependencies and checksums, likely as part of routine dependency maintenance / security and compatibility upgrades.

Changes:

• Bumped multiple indirect Go dependencies to newer versions (e.g., kin-openapi, oapi-codegen, golang.org/x/*).
• Added new indirect YAML module path and updated go.sum accordingly.

Reviewed changes

Copilot reviewed 1 out of 2 changed files in this pull request and generated 1 comment.

File	Description
go/go.mod	Updates indirect dependency versions and introduces go.yaml.in/yaml/v3.
go/go.sum	Refreshes checksums to match updated module graph and new/updated transitive deps.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 3 changed files in this pull request and generated no new comments.