chore: bump github.com/oasdiff/oasdiff from 1.15.3 to 1.16.0 in /tools/cli

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.15.3 to 1.16.0.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.16.0

Two new subcommands (validate, upgrade), cross-version auto-upgrade, and sharper detection

oasdiff validate checks a single spec against the OpenAPI and JSON Schema rules, oasdiff upgrade canonicalises a 3.0 spec to the latest 3.x, --auto-upgrade lets you diff across 3.0 and 3.1 specs directly, and dropping a string format constraint is no longer mis-flagged as breaking.

CLI changes

New validate subcommand

• oasdiff validate <spec> flags per-RFC OpenAPI / JSON Schema violations in a single spec (#894). It fills the gap between the parser (which only catches load and parse errors) and style linters: invalid types, missing required fields, bad regex, unresolved $refs, version-mismatched fields, and more, each with a stable kebab-case rule ID and a file:line:column location. Findings are severity-classified (error, warning, info); -o, --fail-on {ERR|WARN|INFO} (default ERR) controls the exit code, so warnings and info are reported without failing CI unless you lower the threshold. Output is -f text (default), yaml, json, or githubactions (inline pull-request annotations plus per-severity step outputs). A load failure exits 102.

New upgrade subcommand

• oasdiff upgrade <spec> canonicalises an OpenAPI 3.0 spec to the latest 3.x (#922). It rewrites schema-level constructs in place (nullable to a type array, boolean exclusiveMinimum / exclusiveMaximum to numeric, example to examples, and similar) and bumps the version string. The transforms are idempotent: an already-canonical spec is unchanged aside from a possible version bump.

Cross-version comparison

• --auto-upgrade on diff / breaking / changelog / summary (#923). Canonicalises both specs to the latest 3.x before comparing, so a 3.0-vs-3.1 comparison just works instead of reporting spurious dialect-shape differences.

Detection rules

• Removing a string format constraint is a generalization, not breaking (#928, thanks @​igavila). Dropping format from a string schema widens what is accepted, so it is no longer reported as a breaking change.

Flags

• Enum flag values are accepted case-insensitively (#932). --fail-on warn, --level info, -f YAML, --severity error, and similar now work in any case and normalize to the canonical value. Applies to every enum flag across the commands.

Misc

• Git refs documented as a spec input (#931). The help text for the spec arguments now mentions the ref:path form (for example main:openapi.yaml).
• ERRORS.md distinguishes load failures from spec violations (#934) and points to oasdiff validate for a strict per-spec check.

Go package changes

Breaking: formatters.Formatter interface

• Breaking: formatters.Formatter gained a RenderValidate(findings Findings, opts RenderOpts) ([]byte, error) method (#894). Types that embed notImplementedFormatter are unaffected (they inherit a default), but a type that implements the interface directly must add the method.

Misc

• New formatters validate API (#894): the Finding, Findings, and Source types, the OutputValidate output kind, and ComputeFingerprint (now exported, shared by changelog and validate so a downstream tool can match findings across spec versions).
• checker.IsColorEnabled is exported (#894), letting packages outside checker gate color on the same auto-detect plus override convention the commands use.

Commits

• 2c7bf02 docs: link ERRORS.md to the validate command (#934)
• b2f33ff help: note git refs as a supported spec input (#931)
• 2331b7c fix: accept enum flag values case-insensitively (#932)
• 4e8b3b2 feat(validate): new subcommand wrapping kin-openapi's Validate() (#894)
• f63fe0c fix: removing a string format constraint is a generalization, not breaking (#...
• effffd7 feat(diff/breaking/changelog/summary): --auto-upgrade for cross-version specs...
• e0964a8 feat(upgrade): new subcommand canonicalises 3.0 specs to the latest 3.x (#922)
• bc8f99b bump: oasdiff-action v0.0.47 (#921)
• 36c6d77 docs(config-files): cross-link the GitHub Action (#920)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)