Skip to content

chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.5.0 to 2.7.1#294

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/oapi-codegen/oapi-codegen/v2-2.7.1
Open

chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.5.0 to 2.7.1#294
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/github.com/oapi-codegen/oapi-codegen/v2-2.7.1

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/oapi-codegen/oapi-codegen/v2 from 2.5.0 to 2.7.1.

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

Security fix for Go code injection

This is a security fix for a code injection vulnerability in v2.7.0, please see:

GHSA-rjwr-m7qx-3fjr

[!NOTE] A vulnerability like this requires that it is missed in code review and that you then call the malicious method.

Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed.

We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.

This is also why we recommend oapi-codegen generated code is committed to source control.

We're more strict about escaping strings passed into the OpenAPI specification, so that people can't inject Go code into generated code.

The problem was that it was possible to craft a description for server URL's which would emit arbitrary Go code, so if an attacker controlled your specification, they could inject Go code into your generated code which could do something malicious.

v2.7.0: Squashing bugs, many bugs (and adding some features)

Many improvements and even more bug fixes

This v2.7.0 release of oapi-codegen contains quite a bit of internal refactoring, focused on our most historically fragile code paths, which relate to the aggregate types (allOf/anyOf/oneOf), $ref to external specs, enums, and the spec traversal logic missing quite a few leaf nodes where models should have been generated, but were skipped.

The biggest changes are explicitly described in the sections below, and the full list of commits is at the bottom.

Thank you to all contributors, we've been going through all past PR's and updating them and merging where we can, and thanks to all our users for reporting issues that you hit.

I've (@​mromaszewicz) used a lot of LLM help here to scrub through old issues and do some deep internal refactoring to address common problem areas. I intend to continue doing this, since the conditional generation logic is getting quite complicated. When I originally released oapi-codegen, the use case was much simpler, all the models were under #/components/schemas, and all the references to them were in the requests, responses, etc. I never imagine how many things would be external references or unions, and how many complex OpenAPI specifications people would be generating code for. The initial design was never flexible enough to handle that, so ongoing bug fixes are getting increasingly complex due to edge cases. This version has a lot of internal changes you won't see as a user, but the way we handle type generation internally is unifying lots of copy/paste re-implementations into reusable code for consistency. Most of these changes can be done transparently, but some can't, so, onto the changes:

Code generation changes which might require some changes on your end

This release contains three changes, all very narrow in scope, which will require some manual adjustment of your own code. We've decided that these are small enough and uncommon enough not to require opt-in, which causes internal complexity. It's always a judgment call with these. If we got it wrong, we're happy to revisit it in a maintenance release.

Strict-server external response refs require strict-server generation in both packages (#2357)

If your strict-server spec uses an external $ref to a components/responses/... defined in another spec, that other spec must also be generated with strict-server: true. Add it to the source spec's config and regenerate:

# config for the spec being $ref'd
generate:
  models: true
  strict-server: true   # now required when imported by a strict-server spec

This restores the v2.0.0 behavior that lets you cast response models across package boundaries — the standard pattern for sharing error models (e.g. a common 400) across services. PR #1387 had silently changed the embedded type from N400JSONResponse to the bare externalRef0.N400, so the local and external response structs no longer had matching types and casts stopped compiling.

Many more anonymous inner schemas are now hoisted into top level schemas

... (truncated)

Commits

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Jul 17, 2026
@github-actions

github-actions Bot commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown

❌MegaLinter analysis: Error

Descriptor Linter Files Fixed Errors Warnings Elapsed time
✅ ACTION actionlint 4 0 0 0.11s
✅ API spectral 2 0 0 2.44s
✅ COPYPASTE jscpd yes no no 2.26s
✅ DOCKERFILE hadolint 1 0 0 0.16s
✅ GO golangci-lint yes yes no no 59.56s
✅ GO revive yes no no 1.95s
✅ MARKDOWN markdownlint 2 0 0 0 0.7s
✅ MARKDOWN markdown-table-formatter 2 0 0 0 0.3s
✅ REPOSITORY checkov yes no no 45.5s
✅ REPOSITORY gitleaks yes no no 0.38s
✅ REPOSITORY git_diff yes no no 0.0s
✅ REPOSITORY grype yes no no 88.59s
✅ REPOSITORY secretlint yes no no 0.82s
✅ REPOSITORY syft yes no no 2.87s
❌ REPOSITORY trivy yes 1 no 25.9s
✅ REPOSITORY trivy-sbom yes no no 3.27s
✅ REPOSITORY trufflehog yes no no 5.46s
✅ SPELL lychee 14 0 0 0.12s
✅ YAML prettier 12 0 0 0 0.82s
✅ YAML v8r 12 0 0 17.51s
✅ YAML yamllint 12 0 0 0.86s

Detailed Issues

❌ REPOSITORY / trivy - 1 error 
2026-07-22T04:31:19Z	INFO	[vulndb] Need to update DB
2026-07-22T04:31:19Z	INFO	[vulndb] Downloading vulnerability DB...
2026-07-22T04:31:19Z	INFO	[vulndb] Downloading artifact...	repo="mirror.gcr.io/aquasec/trivy-db:2"
1.00 MiB / 101.24 MiB [>_____________________________________________________________] 0.99% ? p/s ?3.38 MiB / 101.24 MiB [-->___________________________________________________________] 3.34% ? p/s ?5.76 MiB / 101.24 MiB [--->__________________________________________________________] 5.69% ? p/s ?8.29 MiB / 101.24 MiB [---->____________________________________________] 8.19% 12.17 MiB p/s ETA 7s10.86 MiB / 101.24 MiB [----->_________________________________________] 10.72% 12.17 MiB p/s ETA 7s13.36 MiB / 101.24 MiB [------>________________________________________] 13.19% 12.17 MiB p/s ETA 7s15.94 MiB / 101.24 MiB [------->_______________________________________] 15.74% 12.20 MiB p/s ETA 6s18.45 MiB / 101.24 MiB [-------->______________________________________] 18.23% 12.20 MiB p/s ETA 6s20.97 MiB / 101.24 MiB [--------->_____________________________________] 20.71% 12.20 MiB p/s ETA 6s23.49 MiB / 101.24 MiB [---------->____________________________________] 23.20% 12.23 MiB p/s ETA 6s28.04 MiB / 101.24 MiB [------------->_________________________________] 27.70% 12.23 MiB p/s ETA 5s39.67 MiB / 101.24 MiB [------------------>____________________________] 39.19% 12.23 MiB p/s ETA 5s59.16 MiB / 101.24 MiB [--------------------------->___________________] 58.43% 15.26 MiB p/s ETA 2s79.80 MiB / 101.24 MiB [------------------------------------->_________] 78.82% 15.26 MiB p/s ETA 1s99.78 MiB / 101.24 MiB [---------------------------------------------->] 98.55% 15.26 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 18.81 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 18.81 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 18.81 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 17.60 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 17.60 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 17.60 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 16.46 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 16.46 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 16.46 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 15.40 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 15.40 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 15.40 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 14.41 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 14.41 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 14.41 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 13.48 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 13.48 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 13.48 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 12.61 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 12.61 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 12.61 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 11.79 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 11.79 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 11.79 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 11.03 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 11.03 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 11.03 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 10.32 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 10.32 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------->] 100.00% 10.32 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 9.66 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 9.66 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 9.66 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 9.03 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 9.03 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 9.03 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 8.45 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 8.45 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 8.45 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 7.91 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 7.91 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 7.91 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 7.40 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 7.40 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 7.40 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.92 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.92 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.92 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.47 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.47 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.47 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.05 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.05 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 6.05 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 5.66 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 5.66 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 5.66 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 5.30 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 5.30 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 5.30 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 4.96 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 4.96 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 4.96 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 4.64 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [--------------------------------------------->] 100.00% 4.64 MiB p/s ETA 0s101.24 MiB / 101.24 MiB [-------------------------------------------------] 100.00% 6.35 MiB p/s 16s2026-07-22T04:31:37Z	INFO	[vulndb] Artifact successfully downloaded	repo="mirror.gcr.io/aquasec/trivy-db:2"
2026-07-22T04:31:37Z	INFO	[vuln] Vulnerability scanning is enabled
2026-07-22T04:31:37Z	INFO	[misconfig] Misconfiguration scanning is enabled
2026-07-22T04:31:37Z	INFO	[checks-client] Need to update the checks bundle
2026-07-22T04:31:37Z	INFO	[checks-client] Downloading the checks bundle...
234.65 KiB / 234.65 KiB [--------------------------------------------------------->] 100.00% ? p/s ?234.65 KiB / 234.65 KiB [--------------------------------------------------------->] 100.00% ? p/s ?234.65 KiB / 234.65 KiB [---------------------------------------------] 100.00% 873.60 KiB p/s 500ms2026-07-22T04:31:43Z	INFO	Number of language-specific files	num=1
2026-07-22T04:31:43Z	INFO	[gomod] Detecting vulnerabilities...
2026-07-22T04:31:43Z	INFO	Detected config files	num=2
2026-07-22T04:31:43Z	WARN	Using severities from other vendors for some vulnerabilities. Read https://trivy.dev/docs/v0.69/guide/scanner/vulnerability#severity-selection for details.

Report Summary

┌──────────────────┬────────────┬─────────────────┬───────────────────┐
│      Target      │    Type    │ Vulnerabilities │ Misconfigurations │
├──────────────────┼────────────┼─────────────────┼───────────────────┤
│ go.mod           │   gomod    │        2        │         -         │
├──────────────────┼────────────┼─────────────────┼───────────────────┤
│ Dockerfile       │ dockerfile │        -        │         0         │
├──────────────────┼────────────┼─────────────────┼───────────────────┤
│ Dockerfile.local │ dockerfile │        -        │         0         │
└──────────────────┴────────────┴─────────────────┴───────────────────┘
Legend:
- '-': Not scanned
- '0': Clean (no security findings detected)


For OSS Maintainers: VEX Notice
--------------------------------
If you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement.
VEX allows you to communicate the actual status of vulnerabilities in your project, improving security transparency and reducing false positives for your users.
Learn more and start using VEX: https://trivy.dev/docs/v0.69/guide/supply-chain/vex/repo#publishing-vex-documents

To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable.


go.mod (gomod)
==============
Total: 2 (UNKNOWN: 2, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌─────────────────────┬────────────────┬──────────┬──────────┬───────────────────┬───────────────┬──────────────────────────────────────────────────────────┐
│       Library       │ Vulnerability  │ Severity │  Status  │ Installed Version │ Fixed Version │                          Title                           │
├─────────────────────┼────────────────┼──────────┼──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ golang.org/x/crypto │ GO-2026-5932   │ UNKNOWN  │ affected │ v0.53.0           │               │ The golang.org/x/crypto/openpgp package is unmaintained, │
│                     │                │          │          │                   │               │ unsafe by design, and has known security...              │
├─────────────────────┼────────────────┤          ├──────────┼───────────────────┼───────────────┼──────────────────────────────────────────────────────────┤
│ golang.org/x/text   │ CVE-2026-56852 │          │ fixed    │ v0.38.0           │ 0.39.0        │ Infinite loop on invalid input in golang.org/x/text      │
│                     │                │          │          │                   │               │ https://avd.aquasec.com/nvd/cve-2026-56852               │
└─────────────────────┴────────────────┴──────────┴──────────┴───────────────────┴───────────────┴──────────────────────────────────────────────────────────┘

📣 Notices:
  - Version 0.72.0 of Trivy is now available, current version is 0.69.1

To suppress version checks, run Trivy scans with the --skip-version-check flag

See detailed reports in MegaLinter artifacts

Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)

  • Documentation: Custom Flavors
  • Command: npx mega-linter-runner@9.4.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,API_SPECTRAL,COPYPASTE_JSCPD,DOCKERFILE_HADOLINT,GO_GOLANGCI_LINT,GO_REVIVE,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R

MegaLinter is graciously provided by OX Security
Show us your support by starring ⭐ the repository

@dependabot
chore(deps): bump github.com/oapi-codegen/oapi-codegen/v2
432dd04 
Bumps [github.com/oapi-codegen/oapi-codegen/v2](https://github.com/oapi-codegen/oapi-codegen) from 2.5.0 to 2.7.1.
- [Release notes](https://github.com/oapi-codegen/oapi-codegen/releases)
- [Commits](oapi-codegen/oapi-codegen@v2.5.0...v2.7.1)

---
updated-dependencies:
- dependency-name: github.com/oapi-codegen/oapi-codegen/v2
  dependency-version: 2.7.1
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/github.com/oapi-codegen/oapi-codegen/v2-2.7.1 branch from 58d3026 to 432dd04 Compare July 22, 2026 04:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@iggy iggy

Labels

dependencies Pull requests that update a dependency file go Pull requests that update Go code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@iggy