chore(deps): bump github.com/oasdiff/oasdiff from 1.20.0 to 1.24.0 in /tools/cmd/scraper

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.20.0 to 1.24.0.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.24.0

Richer validate, per-endpoint review blocks, kin-openapi v0.143.0

Two new validate lints (duplicate enum values, ambiguous parameter serialization), validation rule IDs now sourced from kin-openapi's stable codes, per-endpoint block extraction so the --open review scales to large specs, and correct source locations for $refs into arbitrary top-level keys. Built on kin-openapi v0.143.0.

CLI changes

validate

• New lint: duplicate enum values (#1023, closes #980). oasdiff validate now warns (duplicate-enum-value) when an enum lists the same value more than once. JSON Schema says enum values SHOULD be unique and kin-openapi does not reject them, so this is an oasdiff-native SHOULD-level check. It visits every schema in the document via WalkSchemas, so components, paths, webhooks, and all sub-schema keywords are covered, and the finding points at the exact JSON Pointer.
• New lint: ambiguous parameter serialization (#1103, closes #1055). Warns (ambiguous-parameter-serialization) when a parameter's schema type union mixes a structured type (array / object) with a scalar, e.g. type: [array, integer]. Style serialization is defined per type, so a server cannot tell whether ?token=5 is the array ["5"] or the integer 5. null is excluded from the check (it carries no serialization of its own) and two scalars are fine.
• Rule IDs now come from kin-openapi's declared codes (#1101, #1106). The IDs validate emits are the stable codes kin-openapi declares on each validation error, gated against a fixed registry so the public ID surface cannot drift silently on a dependency bump. Spellings are unchanged, with one refinement: two errors that previously reported the generic spec-validation-error now report their specific codes, duplicate-required-field and duplicate-tag.

--open review

• Per-endpoint block extraction for large specs (#1068). The side-by-side review slices each change into its own structural block per endpoint, so a very large spec renders the affected operation or schema rather than the whole document. Combined with the origin fix below, a change behind a cross-file $ref, including a $ref to a schema under an arbitrary top-level key, is sliced from the file it actually lives in.

Fixes

• Correct source locations for $refs into arbitrary top-level keys (via kin-openapi v0.143.0). A $ref to a schema stored under a non-components top-level key (./schemas.yaml#/User, the Swagger-2-era "definitions bag") used to lose its origin, so a change to it was reported at the referencing operation. It now reports the schema's own file and line, in -f json sources and in the review.

Go package changes

• Dependency: kin-openapi v0.143.0 (#1105, #1098). Removes the exported openapi3.StringMap[V] type (an internal helper, now just map[string]V), adds T.WalkParameters, preserves origins for $refs into arbitrary top-level keys, and declares stable codes on validation errors (openapi3.CodedError, openapi3.ValidationErrorCodes()). If your Go code referenced openapi3.StringMap, switch to map[string]V.
• Modernization (#1100, #1096). The errors.As dispatch is converted to Go 1.26 errors.AsType, and the flatten package now walks schemas via openapi3.WalkSchemas instead of a hand-rolled traversal.

Plus routine dependency bumps (#1099, #1104).

v1.23.0

Nullability changes recognized in every form, at every level

OpenAPI has three equivalent ways to make a schema nullable: the nullable keyword (3.0), a "null" entry in the type array (3.1), and wrapping the schema in oneOf: [{type: "null"}, X], the common idiom for $ref'd schemas. oasdiff now recognizes all three as one thing and reports a single became-nullable or became-not-nullable finding, in both directions, for bodies, properties, parameters, and parameter properties. The new nullability guide explains the model, when a nullability change is breaking, and the deliberate limits.

CLI changes

• Wrapping a schema in oneOf: [{type: "null"}, X] is one INFO finding, not false breaking errors (#1089, fixes #1088, thanks @​katepol for the report). The wrap moves the schema one level down, so the enum used to read as removed (two false request-property-enum-value-removed errors per wrapped enum), plus pattern-removed, one-of-added, and type-generalized noise. oasdiff now proves the wrapped branch is equivalent to the original and reports one became-nullable. The recognition declines conservatively when the edit is more than a pure wrap: an already-nullable schema, a branch that also changed (the constraint reports remain), or a null branch added to a multi-branch oneOf.
• Removing the wrapper is one became-not-nullable finding (#1092, fixes #1091). The reverse edit used to report echoes, including a false request-property-became-enum and a false new-required-request-property. On the request side this is an error (the request no longer accepts null); on the response side it is informational, via the new response-body-became-not-nullable and response-property-became-not-nullable verdicts, which also cover the keyword and type-array forms that previously reported nothing at all on responses.
• Parameters get nullability checks (#1093, fixes #1017). A query, path, or header parameter flipping between type: [string, "null"] and type: string was silent in both directions, although the removal direction is breaking. New verdicts: request-parameter-became-nullable (info), request-parameter-became-not-nullable (error), and the request-parameter-property-* pair for properties of object parameters. Response headers are not covered yet (#1094).
• Changelog output schema additions: six new rule ids (the response and parameter became-(not-)nullable families), localized in all four locales.

Go package changes

• Breaking: Formatter.RenderChangelog no longer takes version strings (#1085). Only the HTML and markup formatters render the base and revision versions, so the versions moved into those formatters' options and off the shared interface; the other six formatters no longer carry dead parameters.
• Breaking: ComputeFingerprint moved from formatters to checker (#1086). It computes a change's stable identity from checker.Change fields and has no formatting logic; callers that only need a fingerprint no longer depend on the output-rendering package. Call sites change from formatters.ComputeFingerprint to checker.ComputeFingerprint; output is byte-identical.
• New: ApiChange.WithSchema and the schema transitions table (#1089, #1092). Checkers no longer carry suppression code: a change built with WithSchema(node) is dropped automatically when a recognized schema transition at that node explains it (checker/transition_claims.go pairs each recognition with the finding kinds it claims and the rules that report it). diff.SchemaDiff gains NullableWrappingDiff.

Changelog

• 48c3e04facf8c4dba125e1f88a4212aed5c1c7bc docs: note the response-header limitation in NULLABILITY.md (#1094) (#1095)
• b3a525077668195639eb13726bef5c2d8646aae7 feat(checker): nullability checks for parameters (#1017) (#1093)
• 3433af958d2a9a38d53aa417911e640d1862faea fix: report nullability removal as became-not-nullable (#1091) (#1092)
• 1e3edff0df52c082c3328269373093cac03d6e11 fix(diff): recognize the nullable oneOf wrapping (#1088) (#1089)

... (truncated)

Commits

• 20e22eb feat(review): per-endpoint structural block extraction for large specs (#1068)
• cfbfbc1 validate: flag a parameter whose type union mixes structured and scalar (#105...
• bc42d62 validate: use kin's validation-error codes instead of deriving rule IDs (#1106)
• 69ff6fc deps: bump kin-openapi to v0.143.0 (#1105)
• d72589e chore(deps): bump actions/setup-go from 6 to 7 in the actions group (#1104)
• 0c7f48d validate: fixed registry of rule IDs; gate derived IDs through it (#1101)
• 4a3ab86 validate: convert errors.As to errors.AsType (#1100)
• 2414729 chore(deps): bump github.com/getkin/kin-openapi from 0.141.0 to 0.142.0 (#1098)
• 3c965e7 chore(deps): bump github.com/yuin/goldmark from 1.8.2 to 1.8.4 (#1099)
• 79f0e57 refactor(flatten): walk schemas via openapi3.WalkSchemas (#1096)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #73.