chore(deps): bump github.com/oasdiff/oasdiff from 1.20.0 to 1.21.0 in /tools/cmd/scraper

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.20.0 to 1.21.0.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.21.0

Sharper response-side detection, a crash fix for schema-less media types, and clearer change messages

This release fixes a panic in oasdiff breaking when a media type gains or loses a schema, fills in the response-side mirrors of several breaking-change checks (response type widening/narrowing, added response headers, media-type schema add/remove), refines when a scalar-to-array query parameter counts as breaking, and rewrites the type/format change messages to read in plain English.

CLI changes

Crash fix

• No more panic when a media type gains or loses a schema (#1049, thanks @​JosefKuchar for the clean repro and root-cause analysis, and @​SAY-5 for an independent fix that confirmed it). A response declared as content: { application/json: {} } in the base that adds schema: { type: string } in the revision (or the reverse) used to nil-panic deep inside the per-schema checks. The schema walkers now skip a media type whose schema is present on only one side, so none of the ~70 checks built on them can dereference a missing Base/Revision. The add/remove is still reported (see below).

Response-side detection (filling in the contravariant mirrors)

• Response body/property type changes now report widening vs narrowing, not a generic change (#1065). A response type that narrows (number to integer) produced no finding at all, and a widening was reported with the generic response-*-type-changed. The verdict is now split three ways, the mirror of the request side: a narrowed return type is response-*-type-specialized (INFO), a widened one is response-*-type-generalized (ERR), and a genuinely incompatible change stays response-*-type-changed (ERR).
• A media type schema added or removed where there was none is now classified (#1051). Building on the crash fix, this case is reported as the change it is: request-body-media-type-schema-added (ERR, input that accepted anything now requires a shape) and response-body-media-type-schema-removed (WARN, a typed response is no longer guaranteed) are the breaking directions, with request-body-media-type-schema-removed and response-body-media-type-schema-added as their INFO duals.
• Adding a response header is now reported (#1057). Only header removal had a rule; the mirror response-header-added now fires at INFO as a non-breaking changelog entry.

Query parameter widening

• Scalar to form/explode array widening is now correct in the cases #915 got wrong (#1024, fixes #918). A query parameter widening from a scalar to a form/explode array of the same scalar is safe exactly when the array's item still accepts every value the base accepted. Two refinements follow: OpenAPI 3.1 nullable shapes (["string"] to ["array","null"]) and weakly-typed multi-type bases ([string,integer] to array<string>) are now correctly reported as generalizations, while an item that narrows the value contract (string to array<string> with an added pattern that would reject ?token=5) is now correctly reported as breaking. The generalization verdict carries a comment explaining the form/explode reasoning, since a scalar-to-array change reads like a breaking one. Deliberate trade-off: widening to an array while simultaneously loosening the item is genuinely safe but now reported as breaking, the correct side to err on.

oneOf wrapping

• Wrapping a body in a oneOf now emits a single finding (#1060, #1038, follow-up to #702). Wrapping a concrete object body into a oneOf of alternatives used to produce overlapping findings: *-body-wrapped-in-one-of plus *-body-one-of-added plus a top-level *-body-type-changed/-generalized (the wrapper has no type, so it read as any). On the response side, contravariance made all three ERR, so a single wrapping produced three breaking findings. The redundant one-of-added and body type change are now suppressed when an OneOfWrappingDiff is present, so each wrapped body emits exactly one accurate finding on each side.

Misc

• Type/format change messages are now readable (#1056). The old the type/format was generalized from string/`` to array, null/``` is replaced by the type was generalized from string to array<string>, null``: an empty format is folded away, arrays show their item type, an unset type renders as any, and the message names the dimension that actually changed (type, format, or type/format`). Check ids and levels are unchanged; only the human-facing text and its arguments change. The RU translations for these messages were also rewritten for consistency.
• Type generalize/specialize messages now say "was widened" / "was narrowed" (#1067). Plainer English than "was specialized from number to integer", matching the wording the list-of-types messages already use, across all four locales. The rule ids keep the generalize/specialize terms.

Go package changes

Breaking: structured security requirement diff

• Breaking: security requirement diff alternatives are now structured, index-keyed values (#1044). The diff output schema for security requirements changed: Added/Deleted go from []string to SecurityAlternatives ([]SecurityAlternative, each { Index, Schemes map[string][]string }), and Modified goes from map[string]SecurityScopesDiff to ModifiedSecurityRequirements ([]*ModifiedSecurityRequirement). This models a security: list as the unordered set of OR-alternatives it is, so a removed alternative that shares a scheme with others is now unambiguous in both the structured diff output and the changelog message (the endpoint scheme security petstore_auth: [admin:pets] was removed). Consumers of the structured oasdiff diff output for security requirements need to update.

Misc

• Breaking: the property-walk primitives are no longer exported (#1063, closes #953). checker.CheckModifiedPropertiesDiff / CheckAddedPropertiesDiff / CheckDeletedPropertiesDiff had zero external callers (verified across this repo and oasdiff-service) and were internal primitives consumed by the media-type walker. They are now unexported. No CLI or output impact; a library-only API-surface reduction.

v1.20.1

What's changed

Security diff

• Phantom security-scope diff fixed (#1043, thanks to @​siem-moneybird for the report and a working reference fix): an OR of scopes written by repeating a scheme (- petstore_auth: [read] / - petstore_auth: [write]) no longer reports a spurious scope add/remove, even diffing a spec against itself.
• Security diff output restructured (#1044): in -f json / -f yaml, securityRequirements.added / deleted are now objects with index and

... (truncated)

Commits

• b7079c0 checker: phrase type generalize/specialize messages as "widened"/"narrowed" (...
• 97fd032 checker: report response type generalize/specialize, not just changed (#989 G...
• ad33cc3 test(checker): drop the vestigial BC:/CL: prefixes from test comments (#1066)
• 6f5318b test(checker): migrate positional GetId asserts to requireChange (closes #905...
• 66d4f16 checker: privatize CheckModified/Added/DeletedPropertiesDiff (closes #953) (#...
• 6e8a319 test(checker): skip TestRuleLevels on Windows (CRLF golden checkout) (#1062)
• 97125fc test(checker): route ApiChange equality through a helper so new fields don't ...
• 1577541 checker: emit a single finding for a oneOf wrapping, suppress the mechanical ...
• 1ee34a8 fix(checker): mirror oneOf-wrapping on the response side (#702) (#1038)
• a93fa4a checker tests: add requireChange/requireNoChange and migrate positional asser...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #65.