chore: bump github.com/oasdiff/oasdiff from 1.24.0 to 1.27.0 in /tools/cli

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.24.0 to 1.27.0.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.27.0

This release adds a versioning policy, more validate lints, and reorganizes oasdiff checks into one listing per rule set.

CLI changes

Versioning policy

• A breaking change now reports the version bump it did not get. If you version your API with semver, oasdiff compares info.version on each side against the severity of the changes it found, and reports a breaking change that shipped without a major version increase. There are three ids, one per way to violate the policy: api-version-not-bumped (the version is unchanged), api-version-decreased (it moved backwards), and api-major-version-not-bumped (it moved, but not the major). All default to INFO, so nothing fails on their own; raise them to err with --severity-levels to enforce, or set them to none to switch them off (#1133, closing #1007, from a request by @​rethab in oasdiff-action#154). Nothing is reported unless a breaking change is present and both versions parse as semver, so specs versioned by date, by a bare v1, or not at all are left alone. Below 1.0.0 a minor bump satisfies the policy, since semver gives the minor the major's role there. See VERSIONING.md.

oasdiff checks now names its rule set

• oasdiff checks on its own prints the available listings instead of the changelog rules. There is now one listing per rule set: oasdiff checks changelog for the rules breaking and changelog apply, and oasdiff checks validate for the rules validate reports (#1132). If you script oasdiff checks, add the changelog subcommand. The validate rules had no listing at all before this.

New validate lints

• Schema constraints that nothing can satisfy are reported as errors: minimum above maximum, and the same for minLength/maxLength, minItems/maxItems, minProperties/maxProperties and minContains/maxContains (#1122).
• type-format-mismatch: a format that belongs to a different type is reported as a warning, since it is silently ignored at runtime, for example format: date-time on an integer (#1120).

Severity and flag changes

• request-body-enum-value-removed is now breaking by default. Removing an enum value from a request body rejects payloads that were valid before, which is an error, not an informational note (#1118).
• --include-checks is deprecated and ignored, and the optional-checks mechanism behind it is retired. All checks now run, and severity is the only lever. If you used --include-checks to make an optional check fail the build, it no longer does: the check now reports at its default severity, so move those ids into --severity-levels with err to keep the gate. The flag still parses and prints a notice on stderr. --flatten and --max-circular-dep are likewise deprecated, each pointing at its replacement (#1119).

Misc

• A revision starting with a dash is no longer parsed as a git option (#1125).
• Documented that source locations require a YAML spec (#1129) and how to pass arguments safely from a script or CI (#1126).
• Dependency bumps: kin-openapi 0.145.0, goldmark 1.8.5, yaml/v3 3.0.5.

Go package changes

• diff.Diff carries BaseInfo and RevisionInfo (*openapi3.Info), the info object from each spec, following the same Base/Revision convention as PathsDiff and SchemaDiff. They are populated only on a non-empty diff and excluded from JSON and YAML output, so Empty() and the diff output are unchanged (#1133).
• New checker.InfoChange, for findings whose subject is the document rather than an endpoint. It implements checker.Change like ApiChange, ComponentChange and SecurityChange, with an empty path and operation and GetSection() == "info". Code that type-switches over change types should expect it (#1133).
• The optional-checks API is gone with the mechanism it served: GetOptionalChecks, GetOptionalRules and the WithOptionalChecks option no longer exist, and GetAllChecks returns every check. Callers that enabled optional checks should set the severity of the ids they care about instead (#1119).

v1.26.1

Security patch release. Cut directly off v1.26.0 so it contains this fix and nothing else.

CLI changes

Security: a git revision could be parsed by git as an option (GHSA-m3wq-w7x2-4q6m)

• Git revisions are no longer parsed as git options. oasdiff passed git revisions to git as operands without an end-of-options separator, so a revision beginning with - was parsed by git as an option rather than a revision. git show --output=<path> writes git's output to that path, an arbitrary file overwrite running as the invoking user, and git fetch --upload-pack=<program> makes git execute that program (reachable through the opt-in --fetch flag).

  Running oasdiff directly from a shell was not the exposed path: the CLI's own flag parser rejects a leading-dash positional. The issue was reachable after a -- separator, and, more importantly, through the Go library API, which an embedding program can call with a revision from an untrusted source, and through wrappers that pass a revision through from input or configuration.

  Fixed in two layers: every git invocation now passes --end-of-options, so git treats what follows as an operand, and a revision beginning with - is rejected before git is invoked. The second layer does not depend on the git version (--end-of-options landed in git 2.24) and produces a clear error instead of a confusing one from git. No legitimate git revision begins with -, so nothing valid is refused.

Who should upgrade: anyone calling the load package (or any oasdiff API that loads from a git revision) with a revision that is not a hardcoded literal, and anyone wrapping the CLI in a script that interpolates untrusted input into a revision argument.

... (truncated)

Commits

• fb8babb checker: report a breaking change released without a major version bump (#1133)
• 94c30cf checks: one listing per rule set, and list the validate rules (#927) (#1132)
• e5236e5 validate: schema-constraint lints (#927) (#1122)
• bf4eab6 chore(deps): bump github.com/yuin/goldmark from 1.8.4 to 1.8.5 (#1130)
• 5d2c775 docs: document that source locations require a YAML spec (#1129)
• a7e004f chore(deps): bump github.com/getkin/kin-openapi from 0.144.0 to 0.145.0 (#1123)
• 494bcf9 chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#1124)
• 5ac0657 chore: remove the unused Claude Code workflow (#1127)
• 6f57919 docs: how to pass arguments safely from a script or CI (#1126)
• 50f4985 security: stop git parsing a revision as an option (#1125)
• Additional commits viewable in compare view