chore(deps): bump github.com/oasdiff/oasdiff from 1.20.0 to 1.25.1 in /tools/cmd/scraper

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.20.0 to 1.25.1.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.25.1

A required request property with a default is now a breaking change (error)

new-required-request-property-with-default and request-property-became-required-with-default are now reported as error (breaking). In v1.25.0 they were briefly reported as warning, and before that as info.

Breaking-ness is a property of the contract your OpenAPI definition declares, not of how a lenient server behaves. A request that omits a required property is invalid under the new contract, whether or not the property has a default. The default is a server-side fallback value; it does not make the omitted property valid. Whether a particular server applies the default and accepts the request anyway is that operator's choice, and other consumers of the same contract (generated client SDKs that make the property a mandatory argument, and strict API gateways that reject the missing field) break regardless.

Each change carries a comment explaining why the default does not make it safe. If the change is safe for your specific ecosystem, downgrade exactly these checks with a severity-levels file, for example a line reading new-required-request-property-with-default info, passed via --severity-levels.

A new section, "How oasdiff decides what is breaking," has been added to the breaking-changes documentation.

Full Changelog: oasdiff/oasdiff@v1.25.0...v1.25.1

v1.25.0

Superseded by v1.25.1. This release briefly reported required-request-property-with-default as a warning; v1.25.1 corrects it to error. Use v1.25.1 or later.

v1.24.0

Richer validate, per-endpoint review blocks, kin-openapi v0.143.0

Two new validate lints (duplicate enum values, ambiguous parameter serialization), validation rule IDs now sourced from kin-openapi's stable codes, per-endpoint block extraction so the --open review scales to large specs, and correct source locations for $refs into arbitrary top-level keys. Built on kin-openapi v0.143.0.

CLI changes

validate

• New lint: duplicate enum values (#1023, closes #980). oasdiff validate now warns (duplicate-enum-value) when an enum lists the same value more than once. JSON Schema says enum values SHOULD be unique and kin-openapi does not reject them, so this is an oasdiff-native SHOULD-level check. It visits every schema in the document via WalkSchemas, so components, paths, webhooks, and all sub-schema keywords are covered, and the finding points at the exact JSON Pointer.
• New lint: ambiguous parameter serialization (#1103, closes #1055). Warns (ambiguous-parameter-serialization) when a parameter's schema type union mixes a structured type (array / object) with a scalar, e.g. type: [array, integer]. Style serialization is defined per type, so a server cannot tell whether ?token=5 is the array ["5"] or the integer 5. null is excluded from the check (it carries no serialization of its own) and two scalars are fine.
• Rule IDs now come from kin-openapi's declared codes (#1101, #1106). The IDs validate emits are the stable codes kin-openapi declares on each validation error, gated against a fixed registry so the public ID surface cannot drift silently on a dependency bump. Spellings are unchanged, with one refinement: two errors that previously reported the generic spec-validation-error now report their specific codes, duplicate-required-field and duplicate-tag.

--open review

• Per-endpoint block extraction for large specs (#1068). The side-by-side review slices each change into its own structural block per endpoint, so a very large spec renders the affected operation or schema rather than the whole document. Combined with the origin fix below, a change behind a cross-file $ref, including a $ref to a schema under an arbitrary top-level key, is sliced from the file it actually lives in.

Fixes

• Correct source locations for $refs into arbitrary top-level keys (via kin-openapi v0.143.0). A $ref to a schema stored under a non-components top-level key (./schemas.yaml#/User, the Swagger-2-era "definitions bag") used to lose its origin, so a change to it was reported at the referencing operation. It now reports the schema's own file and line, in -f json sources and in the review.

Go package changes

• Dependency: kin-openapi v0.143.0 (#1105, #1098). Removes the exported openapi3.StringMap[V] type (an internal helper, now just map[string]V), adds T.WalkParameters, preserves origins for $refs into arbitrary top-level keys, and declares stable codes on validation errors (openapi3.CodedError, openapi3.ValidationErrorCodes()). If your Go code referenced openapi3.StringMap, switch to map[string]V.
• Modernization (#1100, #1096). The errors.As dispatch is converted to Go 1.26 errors.AsType, and the flatten package now walks schemas via openapi3.WalkSchemas instead of a hand-rolled traversal.

Plus routine dependency bumps (#1099, #1104).

v1.23.0

Nullability changes recognized in every form, at every level

OpenAPI has three equivalent ways to make a schema nullable: the nullable keyword (3.0), a "null" entry in the type array (3.1), and wrapping the schema in oneOf: [{type: "null"}, X], the common idiom for $ref'd schemas. oasdiff now recognizes all three as one thing and reports a single became-nullable or became-not-nullable finding, in both directions, for bodies, properties, parameters, and parameter properties. The new nullability guide explains the model, when a nullability change is breaking, and the deliberate limits.

CLI changes

... (truncated)

Commits

• 0a97c00 checker: a required request property with a default is breaking (error), not ...
• a313791 docs: validate's duplicate-enum lint; allOf's dropped keywords (#1108)
• c2062aa checker: warn (not info) when a required request property has a default (#1109)
• a94e0a5 docs: bring CUSTOMIZING-CHECKS up to the rules registry (#1107)
• 20e22eb feat(review): per-endpoint structural block extraction for large specs (#1068)
• cfbfbc1 validate: flag a parameter whose type union mixes structured and scalar (#105...
• bc42d62 validate: use kin's validation-error codes instead of deriving rule IDs (#1106)
• 69ff6fc deps: bump kin-openapi to v0.143.0 (#1105)
• d72589e chore(deps): bump actions/setup-go from 6 to 7 in the actions group (#1104)
• 0c7f48d validate: fixed registry of rule IDs; gate derived IDs through it (#1101)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #76.