chore(deps): bump github.com/oasdiff/oasdiff from 1.20.0 to 1.26.1 in /tools/cmd/scraper

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.20.0 to 1.26.1.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.26.1

Security patch release. Cut directly off v1.26.0 so it contains this fix and nothing else.

CLI changes

Security: a git revision could be parsed by git as an option (GHSA-m3wq-w7x2-4q6m)

• Git revisions are no longer parsed as git options. oasdiff passed git revisions to git as operands without an end-of-options separator, so a revision beginning with - was parsed by git as an option rather than a revision. git show --output=<path> writes git's output to that path, an arbitrary file overwrite running as the invoking user, and git fetch --upload-pack=<program> makes git execute that program (reachable through the opt-in --fetch flag).

  Running oasdiff directly from a shell was not the exposed path: the CLI's own flag parser rejects a leading-dash positional. The issue was reachable after a -- separator, and, more importantly, through the Go library API, which an embedding program can call with a revision from an untrusted source, and through wrappers that pass a revision through from input or configuration.

  Fixed in two layers: every git invocation now passes --end-of-options, so git treats what follows as an operand, and a revision beginning with - is rejected before git is invoked. The second layer does not depend on the git version (--end-of-options landed in git 2.24) and produces a clear error instead of a confusing one from git. No legitimate git revision begins with -, so nothing valid is refused.

Who should upgrade: anyone calling the load package (or any oasdiff API that loads from a git revision) with a revision that is not a hardcoded literal, and anyone wrapping the CLI in a script that interpolates untrusted input into a revision argument.

Users of the oasdiff GitHub Action get this in oasdiff-action v0.1.10. If you pin the action at @v0 you already have it.

Go package changes

• New exported error load.ErrRefLooksLikeOption, returned for a git revision beginning with -.

v1.26.0

Response header schema checks (#1116)

oasdiff now inspects a response header's schema, not just whether the header exists. Six new checks report type, format, and nullability changes on response headers, closing a gap where a change like Retry-After going from string/date-time to integer was silent in both breaking and changelog:

• response-header-type-changed, response-header-type-generalized (breaking)
• response-header-type-specialized, response-header-type-compatible (info)
• response-header-became-nullable (breaking), response-header-became-not-nullable (info)

A header value is text on the wire, so a response header is classified the same way a scalar parameter is: a bare string to integer swap is backward compatible (the value is still valid text), while dropping a parsed format (date-time to integer) or widening the returned type is breaking.

Note: because these are new detections, a spec with response-header type, format, or nullability changes will now surface findings that earlier versions did not, including new breaking-change errors from oasdiff breaking. Use --severity-levels to adjust any check that does not fit your API.

Thanks to @​nrutman for reporting this against a real API change (a response Retry-After header going from string/date-time to integer) in #1094.

validate: required with a default (#1111)

oasdiff validate now flags a parameter or property that is both required and carries a default. A default only applies when a value is omitted, so it can never take effect for a value the client is required to send. The two together are usually a mistake.

Encrypted review bundle records its origin (#1113)

A --open review bundle now carries the oasdiff version and platform that produced it, so the review page can tell when a review was created by an outdated client.

Docs and dependencies

• The online rule catalog link now points to the consolidated breaking-changes page (#1112).
• Bump kin-openapi to 0.144.0 (#1115).

v1.25.1

... (truncated)

Commits

• 47e76df security: stop git parsing a revision as an option
• 26f1a12 Add response header schema checks: type, format, nullability (#1116)
• 0195d90 chore(deps): bump github.com/getkin/kin-openapi from 0.143.0 to 0.144.0 (#1115)
• 1b75f09 Add OASDIFF_INTERNAL to tag a review as a test review (#1114)
• f441d25 review: include the oasdiff version and platform in the encrypted review bund...
• ebe1dea docs: point the online catalog link to /docs/breaking-changes (#1112)
• 5e4a9a0 validate: flag a required parameter or property that also has a default (#1111)
• 0a97c00 checker: a required request property with a default is breaking (error), not ...
• a313791 docs: validate's duplicate-enum lint; allOf's dropped keywords (#1108)
• c2062aa checker: warn (not info) when a required request property has a default (#1109)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)