[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/oapi-codegen/oapi-codegen/v2	v2.8.0 → v2.8.1
golang.org/x/vuln	v1.7.0 → v1.9.0
honnef.co/go/tools	v0.8.1 → v0.8.2
mvdan.cc/gofumpt	v0.11.0 → v0.12.0

---

Release Notes

oapi-codegen/oapi-codegen (github.com/oapi-codegen/oapi-codegen/v2)

v2.8.1: : Security fixes for codegen and at runtime

Compare Source

🎉 Notable changes

This is a security release on top of v2.8.0. It addresses five security findings reported against oapi-codegen:

• Strict servers could bind a different request body than the one the validation middleware checked (runtime behaviour of generated servers)
• Remote $refs in an untrusted specification could make the generator issue requests to arbitrary hosts (code generation)
• An operationId could inject Go code through the Echo per-operation middleware key (code generation)
• A request body content type could inject Go code through the webhook and callback initiators (code generation)
• Server x-go-name, server variables and non-string enum values could inject Go code (code generation)

Four of the five only matter when you generate code from a specification you do not control. The first one affects running servers, so please upgrade the generated code and the oapi-codegen/runtime and validation middleware modules together, as described below.

Allow-listing the remote documents a specification may reference

oapi-codegen resolves external $refs while it loads a specification. Until now it fetched any http(s) URL a document named, so a specification written by someone else could make the generator reach any host the build machine can see.

There is a new top-level configuration option, allow-remote-refs-from. Each entry is the URL of a referenced document exactly as it appears in the $ref, without the #... fragment, or "*" to allow any URL:

allow-remote-refs-from:
  - https://github.com/@raw/example/specs/main/common.yaml

For compatibility, this release defaults the option to "*" when it is omitted, so existing configurations keep working unchanged. The next minor release will default to refusing remote references. If your specification downloads other documents at generation time, tighten this now by listing them, or set the option to [] to refuse them all.

Better still, for reproducible builds, download the specifications you depend on, commit them next to your own, and reference them by relative path. References to local files are always followed, with no allow-listing involved, and your generated code no longer depends on a remote host being up and unchanged.

Strict servers bind the value the validation middleware validated

A validation middleware decodes the JSON request body to validate it, and the generated strict server then decoded it a second time. encoding/json matches member names case-insensitively, so a body such as

{"role": "user", "ROLE": "admin"}

validates as role: user but was bound as Role: "admin", bypassing the schema's constraints.

Strict servers for every supported framework now bind the value the middleware already validated, with exact member-name matching, and only fall back to decoding the body themselves when no validated value is present. For the fix to take effect you need all three of:

• code generated with this release;
• github.com/oapi-codegen/runtime v1.8.0 or later;
• a validation middleware that keeps the validated value, which the following versions do by default:
  • github.com/oapi-codegen/nethttp-middleware v1.3.1
  • github.com/oapi-codegen/echo-middleware v1.2.1
  • github.com/oapi-codegen/echo-v5-middleware v0.2.1
  • github.com/oapi-codegen/gin-middleware v1.2.1
  • github.com/oapi-codegen/iris-middleware v1.2.1
  • github.com/oapi-codegen/fiber-middleware v1.3.0
  • github.com/oapi-codegen/fiber-v3-middleware v0.3.0

Without them the generated code behaves as before, so the upgrade is safe to roll out in any order, but the fix is only in effect once all three are updated.

Fewer specification strings reach the generated code unescaped

Every string that the generator copies from a specification into Go source is now either emitted through strconv.Quote or checked before generation: content types in the webhook and callback initiators, the Echo per-operation middleware key, security scopes, non-string enum values (which must now be number or boolean literals), response status keys, component names, response header styles, and, when server-urls is enabled, server names, variables and their enum values. Valid specifications generate byte-for-byte the same code as before; a specification that would have produced code it had no business producing is now rejected with an error that points at the offending value.

🐛 Bug fixes

• Quote or validate every spec string that reaches generated Go source (2.8.x backport) (#​2626) @​mromaszewicz
• Apply the allow-remote-refs-from "*" default to the loader used after an overlay (2.8.x) (#​2624) @​mromaszewicz
• Refuse remote $refs unless their host is in allow-remote-refs-from (2.8.x backport, default "*") (#​2623) @​mromaszewicz
• Bind the validated request body value in all strict servers (2.8.x backport) (#​2621) @​mromaszewicz

Sponsors

We would like to thank our sponsors for their support during this release.

We'd also like to thank Greptile for allowing our project to use their code review system.

dominikh/go-tools (honnef.co/go/tools)

v0.8.2

Compare Source

mvdan/gofumpt (mvdan.cc/gofumpt)

v0.12.0

Compare Source

This release is based on Go 1.27's gofmt, and requires Go 1.26 or later.

A standard library import carrying a doc or inline comment is no longer moved
into the top import group, as the comment stayed behind and ended up detached
at the bottom of the group. See #​289.

Moving a standard library import up no longer leaves an empty line where it
used to be, which split the remaining imports into extra groups. See #​225.

A copyright header or package doc no longer makes gofumpt treat a single-line
first declaration as multi-line, adding an empty line after it.

An assignment whose right-hand side is separated by a comment is now left
alone, as merging the lines produced output which gofmt would change back.

---

Configuration

📅 Schedule: (in timezone America/New_York)

• Branch creation
  • "before 10am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=3 days

Details:

Package	Change
golang.org/x/mod	v0.41.0 -> v0.42.0
golang.org/x/telemetry	v0.0.0-20260924152758-ed294f943157 -> v0.0.0-20261010193011-f71dc92da45e
golang.org/x/tools	v0.51.0 -> v0.52.0

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ nathanjcochran
❌ renovate[bot]
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.