chore(deps): bump github.com/oasdiff/oasdiff from 1.20.0 to 1.23.0 in /tools/cmd/scraper

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.20.0 to 1.23.0.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.23.0

Nullability changes recognized in every form, at every level

OpenAPI has three equivalent ways to make a schema nullable: the nullable keyword (3.0), a "null" entry in the type array (3.1), and wrapping the schema in oneOf: [{type: "null"}, X], the common idiom for $ref'd schemas. oasdiff now recognizes all three as one thing and reports a single became-nullable or became-not-nullable finding, in both directions, for bodies, properties, parameters, and parameter properties. The new nullability guide explains the model, when a nullability change is breaking, and the deliberate limits.

CLI changes

• Wrapping a schema in oneOf: [{type: "null"}, X] is one INFO finding, not false breaking errors (#1089, fixes #1088, thanks @​katepol for the report). The wrap moves the schema one level down, so the enum used to read as removed (two false request-property-enum-value-removed errors per wrapped enum), plus pattern-removed, one-of-added, and type-generalized noise. oasdiff now proves the wrapped branch is equivalent to the original and reports one became-nullable. The recognition declines conservatively when the edit is more than a pure wrap: an already-nullable schema, a branch that also changed (the constraint reports remain), or a null branch added to a multi-branch oneOf.
• Removing the wrapper is one became-not-nullable finding (#1092, fixes #1091). The reverse edit used to report echoes, including a false request-property-became-enum and a false new-required-request-property. On the request side this is an error (the request no longer accepts null); on the response side it is informational, via the new response-body-became-not-nullable and response-property-became-not-nullable verdicts, which also cover the keyword and type-array forms that previously reported nothing at all on responses.
• Parameters get nullability checks (#1093, fixes #1017). A query, path, or header parameter flipping between type: [string, "null"] and type: string was silent in both directions, although the removal direction is breaking. New verdicts: request-parameter-became-nullable (info), request-parameter-became-not-nullable (error), and the request-parameter-property-* pair for properties of object parameters. Response headers are not covered yet (#1094).
• Changelog output schema additions: six new rule ids (the response and parameter became-(not-)nullable families), localized in all four locales.

Go package changes

• Breaking: Formatter.RenderChangelog no longer takes version strings (#1085). Only the HTML and markup formatters render the base and revision versions, so the versions moved into those formatters' options and off the shared interface; the other six formatters no longer carry dead parameters.
• Breaking: ComputeFingerprint moved from formatters to checker (#1086). It computes a change's stable identity from checker.Change fields and has no formatting logic; callers that only need a fingerprint no longer depend on the output-rendering package. Call sites change from formatters.ComputeFingerprint to checker.ComputeFingerprint; output is byte-identical.
• New: ApiChange.WithSchema and the schema transitions table (#1089, #1092). Checkers no longer carry suppression code: a change built with WithSchema(node) is dropped automatically when a recognized schema transition at that node explains it (checker/transition_claims.go pairs each recognition with the finding kinds it claims and the rules that report it). diff.SchemaDiff gains NullableWrappingDiff.

Changelog

• 48c3e04facf8c4dba125e1f88a4212aed5c1c7bc docs: note the response-header limitation in NULLABILITY.md (#1094) (#1095)
• b3a525077668195639eb13726bef5c2d8646aae7 feat(checker): nullability checks for parameters (#1017) (#1093)
• 3433af958d2a9a38d53aa417911e640d1862faea fix: report nullability removal as became-not-nullable (#1091) (#1092)
• 1e3edff0df52c082c3328269373093cac03d6e11 fix(diff): recognize the nullable oneOf wrapping (#1088) (#1089)
• a5118c99b5b0616df92d5eb012fff578bb83357a chore: apply gopls modernize suggestions (#1087)
• 7663150a47216582b5db522d12fa1cd7bd382702 checker: move ComputeFingerprint out of formatters (#1086)
• 1bb851f9914044903b3dd96e4347570e0df4fc2c formatters: carry changelog versions only in HTML and Markup (#1085)

v1.22.0

Exact source locations, an OpenAPI 3.1 allOf fix, and a published output schema

Every change reported by breaking and changelog now carries a precise source location, down to the exact field or value that changed. OpenAPI 3.1 multi-type arrays no longer fail --flatten-allof, and a new oasdiff schema command publishes a JSON Schema for the machine-readable output so CI tooling can validate against it.

CLI changes

• OpenAPI 3.1 multi-type arrays no longer fail --flatten-allof (#1079). Any multi-type array such as type: [integer, "null"] (the idiomatic 3.1 way to express nullable) inside a schema touched by allOf merging used to fail with unable to resolve Type conflict: all Type values must be identical, even when there was no conflict at all. The merge now keeps each schema's type array intact and intersects across allOf branches: a multi-type array in a single branch passes through unchanged, identical arrays across branches merge, and integer still resolves as a subset of number. A genuinely empty intersection (e.g. [string, "null"] with [integer]) reports the same conflict error as before. Fixes #1078 (thanks @​katepol for the report) and #535.
• New oasdiff schema command (#1075, thanks @​fuleinist for the request in #1074). Prints a JSON Schema describing the --format json/yaml output of breaking and changelog, reflected directly from the output type so it cannot drift. Non-Go CI tooling can pin the schema to an oasdiff version to validate or type results. The diff JSON is intentionally not covered yet, since its from/to values are too loosely typed for a useful reflected schema.

Exact source locations

• Security changes now report a source location (#1069). Global security, operation-level security, and component OAuth changes (api-global-security-*, api-security-*, api-security-component-oauth-*) previously appeared with no baseSource/revisionSource. They now anchor to the relevant security field or scheme. Known limitation: the two scope-added cases point at their container rather than the exact scope line, pending an upstream parser origin enhancement.
• Stability and sunset-parse changes now report a source location (#1070). The api-stability-*, api-invalid-stability-level, and property stability changes anchor to the exact x-stability-level field, and request-parameter-sunset-parse is located consistently from both checks that emit it. With this, every checker emits a location.
• Sunset and x-extensible-enum changes point at the exact field or value (#1073). api-sunset-* and request-parameter-sunset-* now point at the x-sunset field instead of the containing operation or parameter, and the x-extensible-enum-value-removed checks point at the exact removed value, matching how the enum checks already behave.
• Tag changes point at the tag, not the tags: field (#1076). api-tag-removed / api-tag-added now source the specific tag entry (so removing tag security points at the - security line) and set only the side the tag exists on.

Changelog verdicts

• A loosely-typed type swap is no longer called "narrowed" or "widened" (#1076). A body or property type change such as string to object under a loosely typed media type like application/xml is backward compatible only because everything on the wire is a string, not a genuine narrowing, yet it was reported as response-body-type-specialized ("was narrowed from string to object"). Such swaps are now rerouted to four new INFO verdicts, request-body-type-compatible, request-property-type-compatible, response-body-type-compatible, and response-property-type-compatible, worded "changed from X to Y (backward compatible)". Genuine narrowing or widening, and adding or removing the type constraint entirely, keep their existing verdicts.

Misc

• Type generalize/specialize messages now read "widened" and "narrowed" (#1067). "The type was specialized from number to integer" becomes "was narrowed from number to integer", matching the phrasing the list-of-types messages already use, in all four locales. Message text only: the rule ids and their descriptions keep the generalize/specialize terms.

... (truncated)

Commits

• 48c3e04 docs: note the response-header limitation in NULLABILITY.md (#1094) (#1095)
• b3a5250 feat(checker): nullability checks for parameters (#1017) (#1093)
• 3433af9 fix: report nullability removal as became-not-nullable (#1091) (#1092)
• 1e3edff fix(diff): recognize the nullable oneOf wrapping (#1088) (#1089)
• a5118c9 chore: apply gopls modernize suggestions (#1087)
• 7663150 checker: move ComputeFingerprint out of formatters (#1086)
• 1bb851f formatters: carry changelog versions only in HTML and Markup (#1085)
• ed876e5 fix lint: unchecked deferred Close in the both-stdin test (#1084)
• 4e36774 fix: construct both sides from one read when base and revision are stdin (#1082)
• c4c03e5 docs: state what changelog, breaking, and diff each cover (#1081)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #72.