Bump kin-openapi and x/net past the advisories Trivy reports

Merged
JE
8d ago
+32-13

Trivy (Go SDK) is red on main. This PR bumps the two modules it flags:

ModuleFromToAdvisories
github.com/getkin/kin-openapiv0.146.0v0.149.0CVE-2026-100351, -100352, -100353, -100354. The highest fix is in v0.149.0
golang.org/x/netv0.59.0v0.60.0CVE-2026-78659, -78660, -78663, -78669, -97032

santhosh-tekuri/jsonschema/v6 also moves, from 6.0.2 to 6.0.3, because kin-openapi requires it.

The codegen catch: at kin-openapi 0.149, regenerating the client made Recording.Parent a Recording value instead of *Recording. Go rejects that with invalid recursive type. The schema references itself, and under prefer-skip-optional-pointer oapi-codegen kept that field a pointer only because older kin-openapi reported the cycle.

scripts/enhance-openapi-go-types.sh now adds x-go-type-skip-optional-pointer: false to every property that $refs its own schema. Today that is only Recording.parent. A self-reference through an array, like NavigationItem.menu_items, is a slice and needs nothing. make smithy-build adds that one extension to openapi.json. With it, go generate reproduces client.gen.go exactly as before, so the generated code has no diff.

Verified locally:

  • make smithy-check go-check go-check-drift rs-check-drift ts-check-drift kt-check-drift swift-check-drift url-routes-check passes.
  • trivy fs --severity HIGH,CRITICAL --ignore-unfixed ./go reports 0.

Summary by cubic

Bumps kin-openapi to v0.149.0 and x/net to v0.60.0 to clear the CVEs Trivy flags, and fixes the codegen regression those bumps cause.

At kin-openapi v0.149, oapi-codegen no longer reports Recording.parent as a self-referencing cycle, so it generated parent as a value instead of a pointer, which Go rejects as an invalid recursive type. enhance-openapi-go-types.sh now adds x-go-type-skip-optional-pointer: false to every property that $refs its own schema, which keeps Recording.parent a pointer and regenerates client.gen.go with no diff. jsonschema/v6 moves to v6.0.3 transitively.

The Go conformance runner's go.mod and go.sum now also name x/net v0.60.0, since the runner replaces the SDK with the local go directory that selects it.

Migration

  • Run make smithy-build so openapi.json gets the new x-go-type-skip-optional-pointer extension before regenerating Go types.