Bump kin-openapi to v0.151.0 to clear four HIGH CVEs

Merged
JE
8d ago
+6-6

Main's Security run is red on one job, Trivy (Go SDK): https://github.com/basecamp/basecamp-sdk/actions/runs/39008004399

go/go.mod pins github.com/getkin/kin-openapi v0.144.0 as an indirect dependency, pulled in by the oapi-codegen tool (go mod why -m: oapi-codegen/v2/cmd/oapi-codegen -> pkg/codegen -> kin-openapi/openapi3). Trivy reports four HIGH findings against it:

CVEFixed in
CVE-2026-100351 (ValidationHandler security-requirement bypass)0.147.0
CVE-2026-100352 (YAML NaN/Inf values bypass guards)0.148.0
CVE-2026-100353 (incomplete fix for GHSA-p6wj-qrr4-pgh5)0.149.0
CVE-2026-100354 (uncontrolled recursion on circular refs)0.149.0

This bumps it to the latest release, v0.151.0 (go get + go mod tidy; tidy also moves santhosh-tekuri/jsonschema/v6 6.0.2 -> 6.0.3). go/go.mod is the only module in the repo that references kin-openapi. oapi-codegen stays at v2.8.0, its latest.

Every other job in that run was green, so nothing else is touched.

Verification (local, Go 1.26.9, Trivy 0.74.0)

  • trivy fs --severity HIGH,CRITICAL --ignore-unfixed --exit-code 1 --format table ./go -> go.mod: 0, exit 0. The same command on main's go.mod/go.sum -> the four CVEs above.
  • make go-check-generated-drift -> "No drift detected." cd go && go generate ./... -> no diff; the generator built against the new kin-openapi emits an identical client.gen.go.
  • go run golang.org/x/vuln/cmd/govulncheck@latest ./... (in go/) -> "No vulnerabilities found."
  • go vet ./... and go test ./... (in go/) -> all packages pass.

kin-openapi is only a generator dependency and the generated output is byte-identical, so conformance inputs are unchanged.

Summary by cubic

Bumps github.com/getkin/kin-openapi from v0.144.0 to v0.151.0 in go/go.mod to clear four HIGH CVEs reported by Trivy. kin-openapi is an indirect dependency pulled in by the oapi-codegen tool, so this is a build-time-only change.

Dependencies

  • Resolves CVE-2026-100351, CVE-2026-100352, CVE-2026-100353, and CVE-2026-100354, fixed in kin-openapi v0.147.0 through v0.149.0.
  • go mod tidy also bumps santhosh-tekuri/jsonschema/v6 from v6.0.2 to v6.0.3.
  • Regenerating the Go client against the new generator produces no diff, so generated output stays byte-identical.