kcl-lang / kcl-openapi / 33303408969
64%
main: 64%

LAST BUILD BRANCH: dependabot/go_modules/github.com/stretchr/testify-1.12.1
DEFAULT BRANCH: main
Ran
Jobs 1
Files 18
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 64.044%. Remained the same
33303408969

Pull #166

github

claude 
fix(deps): bump github.com/getkin/kin-openapi to v0.144.0 (fixes #165)

`go.mod` pinned `github.com/getkin/kin-openapi v0.76.0` which is
vulnerable to GHSA-r277-6w6q-xmqw (rated critical): the
`ValidationHandler` in `openapi3filter` silently replaces a nil
`AuthenticationFunc` with `NoopAuthenticationFunc`, causing all
security requirements to be satisfied without authentication — a
fail-open behaviour that contradicts the expected fail-closed
contract of `ValidateRequest` and lets unauthenticated callers
reach protected routes.

The fix lands in kin-openapi v0.144.0 (released 2026-07-23). Bumping
to that version is the smallest jump that closes the vuln; kin-openapi
has had a steady stream of releases since then (latest is v0.149.0)
but the API surface kcl-openapi actually uses (`openapi3.Load*`,
`openapi3.T`, schema walking for the CRD-to-KCL pipeline) is stable
across the range, and the CLI consumer is already on v0.147.0
without complaints, so v0.144.0 is the right floor.

knock-on changes from the bump:

* `github.com/go-openapi/jsonpointer` v0.19.5 → v0.22.5
* `github.com/ghodss/yaml` is no longer required
* `github.com/go-openapi/swag/jsonname` is now pulled in transitively
* `github.com/oasdiff/yaml`, `oasdiff/yaml3`,
  `github.com/santhosh-tekuri/jsonschema/v6` come along for the ride

kin-openapi v0.144.0 declares `go 1.25` in its own `go.mod`, so the
project's `go` directive (1.24.0 → 1.25) and the linux CI matrix
(`go-version: [ '1.24' ]` → `[ '1.25' ]`) have to move with it.
darwin/windows already key off `go-version-file: 'go.mod'`, so they
pick the new version automatically.

Verified locally: `go build ./...` succeeds and `go test ./...`
passes all three test packages (`pkg/cmds`,
`pkg/kube_resource/generator`, `pkg/swagger/generator`).

Fixes #165
Pull Request #166: fix(deps): bump github.com/getkin/kin-openapi to v0.144.0 (fixes #165)

2670 of 4169 relevant lines covered (64.04%)

0.72 hits per line

Jobs
ID Job ID Ran Files Coverage
1 33303408969.1 18
64.04
 GitHub Action Run
Source Files on build 33303408969