chore(deps): bump github.com/oasdiff/oasdiff from 1.20.0 to 1.22.0 in /tools/cmd/scraper

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.20.0 to 1.22.0.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.22.0

Exact source locations, an OpenAPI 3.1 allOf fix, and a published output schema

Every change reported by breaking and changelog now carries a precise source location, down to the exact field or value that changed. OpenAPI 3.1 multi-type arrays no longer fail --flatten-allof, and a new oasdiff schema command publishes a JSON Schema for the machine-readable output so CI tooling can validate against it.

CLI changes

• OpenAPI 3.1 multi-type arrays no longer fail --flatten-allof (#1079). Any multi-type array such as type: [integer, "null"] (the idiomatic 3.1 way to express nullable) inside a schema touched by allOf merging used to fail with unable to resolve Type conflict: all Type values must be identical, even when there was no conflict at all. The merge now keeps each schema's type array intact and intersects across allOf branches: a multi-type array in a single branch passes through unchanged, identical arrays across branches merge, and integer still resolves as a subset of number. A genuinely empty intersection (e.g. [string, "null"] with [integer]) reports the same conflict error as before. Fixes #1078 (thanks @​katepol for the report) and #535.
• New oasdiff schema command (#1075, thanks @​fuleinist for the request in #1074). Prints a JSON Schema describing the --format json/yaml output of breaking and changelog, reflected directly from the output type so it cannot drift. Non-Go CI tooling can pin the schema to an oasdiff version to validate or type results. The diff JSON is intentionally not covered yet, since its from/to values are too loosely typed for a useful reflected schema.

Exact source locations

• Security changes now report a source location (#1069). Global security, operation-level security, and component OAuth changes (api-global-security-*, api-security-*, api-security-component-oauth-*) previously appeared with no baseSource/revisionSource. They now anchor to the relevant security field or scheme. Known limitation: the two scope-added cases point at their container rather than the exact scope line, pending an upstream parser origin enhancement.
• Stability and sunset-parse changes now report a source location (#1070). The api-stability-*, api-invalid-stability-level, and property stability changes anchor to the exact x-stability-level field, and request-parameter-sunset-parse is located consistently from both checks that emit it. With this, every checker emits a location.
• Sunset and x-extensible-enum changes point at the exact field or value (#1073). api-sunset-* and request-parameter-sunset-* now point at the x-sunset field instead of the containing operation or parameter, and the x-extensible-enum-value-removed checks point at the exact removed value, matching how the enum checks already behave.
• Tag changes point at the tag, not the tags: field (#1076). api-tag-removed / api-tag-added now source the specific tag entry (so removing tag security points at the - security line) and set only the side the tag exists on.

Changelog verdicts

• A loosely-typed type swap is no longer called "narrowed" or "widened" (#1076). A body or property type change such as string to object under a loosely typed media type like application/xml is backward compatible only because everything on the wire is a string, not a genuine narrowing, yet it was reported as response-body-type-specialized ("was narrowed from string to object"). Such swaps are now rerouted to four new INFO verdicts, request-body-type-compatible, request-property-type-compatible, response-body-type-compatible, and response-property-type-compatible, worded "changed from X to Y (backward compatible)". Genuine narrowing or widening, and adding or removing the type constraint entirely, keep their existing verdicts.

Misc

• Type generalize/specialize messages now read "widened" and "narrowed" (#1067). "The type was specialized from number to integer" becomes "was narrowed from number to integer", matching the phrasing the list-of-types messages already use, in all four locales. Message text only: the rule ids and their descriptions keep the generalize/specialize terms.
• changelog - - builds both sides from a single stdin read (#1082). When base and revision are both -, the revision was previously loaded from the already-exhausted stdin and patched afterwards, leaving its spec version internally inconsistent and relying on the parser accepting empty input. Both sides are now constructed from one read; output is unchanged (no changes reported, exit 0).

Go package changes

• Breaking: five internal-only checker helpers are unexported (#1072). OperationFieldSources, ParameterFieldSources, SchemaMapItemSource, IsDecreasedValue, and IsIncreasedValue are now package-private. They were source and value-comparison internals with no known external callers; the public entry points (CheckBackwardCompatibility, NewConfig, GetAllRules, and the individual check functions) are unchanged.

v1.21.0

Sharper response-side detection, a crash fix for schema-less media types, and clearer change messages

This release fixes a panic in oasdiff breaking when a media type gains or loses a schema, fills in the response-side mirrors of several breaking-change checks (response type widening/narrowing, added response headers, media-type schema add/remove), refines when a scalar-to-array query parameter counts as breaking, and rewrites the type/format change messages to read in plain English.

CLI changes

Crash fix

• No more panic when a media type gains or loses a schema (#1049, thanks @​JosefKuchar for the clean repro and root-cause analysis, and @​SAY-5 for an independent fix that confirmed it). A response declared as content: { application/json: {} } in the base that adds schema: { type: string } in the revision (or the reverse) used to nil-panic deep inside the per-schema checks. The schema walkers now skip a media type whose schema is present on only one side, so none of the ~70 checks built on them can dereference a missing Base/Revision. The add/remove is still reported (see below).

Response-side detection (filling in the contravariant mirrors)

• Response body/property type changes now report widening vs narrowing, not a generic change (#1065). A response type that narrows (number to integer) produced no finding at all, and a widening was reported with the generic response-*-type-changed. The verdict is now split three ways, the mirror of the request side: a narrowed return type is response-*-type-specialized (INFO), a widened one is response-*-type-generalized (ERR), and a genuinely incompatible change stays response-*-type-changed (ERR).
• A media type schema added or removed where there was none is now classified (#1051). Building on the crash fix, this case is reported as the change it is: request-body-media-type-schema-added (ERR, input that accepted anything now requires a shape) and response-body-media-type-schema-removed (WARN, a typed response is no longer guaranteed) are the breaking directions, with request-body-media-type-schema-removed and response-body-media-type-schema-added as their INFO duals.
• Adding a response header is now reported (#1057). Only header removal had a rule; the mirror response-header-added now fires at INFO as a non-breaking changelog entry.

Query parameter widening

• Scalar to form/explode array widening is now correct in the cases #915 got wrong (#1024, fixes #918). A query parameter widening from a scalar to a form/explode array of the same scalar is safe exactly when the array's item still accepts every value the base accepted. Two refinements follow: OpenAPI 3.1 nullable shapes (["string"] to ["array","null"]) and weakly-typed multi-type bases ([string,integer] to array<string>) are now correctly reported as generalizations, while an item that narrows the value contract (string to array<string> with an added pattern that would reject ?token=5) is now correctly reported as breaking. The generalization verdict carries a comment explaining the form/explode reasoning, since a scalar-to-array change reads like a breaking one. Deliberate trade-off: widening to an array while simultaneously loosening the item is genuinely safe but now reported as breaking, the correct side to err on.

... (truncated)

Commits

• ed876e5 fix lint: unchecked deferred Close in the both-stdin test (#1084)
• 4e36774 fix: construct both sides from one read when base and revision are stdin (#1082)
• c4c03e5 docs: state what changelog, breaking, and diff each cover (#1081)
• c55cd09 docs: remove retired Go Report Card badge, point Go docs badge at pkg.go.dev ...
• 75fc751 checker: pinpoint tag changes and stop calling loosely-typed type swaps narro...
• 71647e0 fix(flatten): accept OpenAPI 3.1 multi-type arrays when merging allOf (#1079)
• 2631bde feat: add oasdiff schema to publish the JSON output schema (#1074) (#1075)
• c38992e feat(checker): point sunset and x-extensible-enum changes at the exact field ...
• f45f815 refactor(checker): unexport internal-only source/value helpers (#1072)
• 40429f9 refactor(checker): construct ApiChange via opInfo.NewApiChange (#1071)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #67.