chore(deps): update dependency oasdiff/oasdiff to v1.30.0

[renovate]

This PR contains the following updates:

Package	Update	Change
oasdiff/oasdiff	minor	1.28.0 → 1.30.0

---

Release Notes

oasdiff/oasdiff (oasdiff/oasdiff)

v1.30.0

Compare Source

Provable check coverage, derived severities, boolean schemas, positional prefixItems

The largest change to breaking-change detection since the checker was introduced: every check's severity is now derived from a single reviewed model of what each change does to the API contract, enforced in CI, with zero recorded exceptions. That audit produced 58 new checks and corrected the severity of 36 existing ones, so some changes that previously passed oasdiff breaking with a warning now fail it, and some that failed now pass. Teams that disagree with any individual verdict can override it with --severity-levels. The release also brings OpenAPI 3.1 boolean schemas (items: false tuples), positional prefixItems comparison, OpenAPI 3.2 QUERY and custom methods, and a new breaking-files command for pre-commit hooks.

CLI changes

Severity corrections: changes that now fail oasdiff breaking

• Setting a bound where none existed is an error, not a warning (#​1174). All 18 request-*-{max,max-length,min,min-items,exclusive-max,exclusive-min}-set checks: adding a bound rejects values the previous contract accepted, the same shape as became-enum, const-added and pattern-added, which were already errors. If your clients are known to stay within the new limit, lower the check with --severity-levels.
• Security requirement and scope changes are errors, not info (#​1174). api-security-removed, api-global-security-removed, api-security-scope-added, api-global-security-scope-added: requirements are alternatives, so removing one strands clients authenticating with it, and scopes are conjunctive, so adding one rejects tokens that lack it.
• Adding a branch or value to a response union is an error (#​1174). response-body-any-of-added and response-property-any-of-added now match response-body-one-of-added, and response-property-enum-value-added is an error: the server may return a value no client was written to handle (use x-extensible-enum for value sets that are meant to grow). response-property-pattern-removed is an error and response-property-pattern-changed a warning for the same reason.

Severity corrections: changes that no longer fail

• Request parameter defaults are informational (#​1174). request-parameter-default-value-{added,changed,removed} drop from error to info, matching the body and property default checks: a default is a server-side fallback and does not change which requests are valid.
• Removing an optional response element is informational (#​1174). response-optional-property-removed and optional-response-header-removed: a conforming client already tolerates the element's absence. request-body-all-of-removed, request-property-all-of-removed and response-required-property-became-not-write-only drop to info on similar reasoning, and response-media-type-name-changed becomes a warning with a comment naming what cannot be determined.
• oneOf wrapping splits on whether the original schema survives (#​1174). Wrapping a body in a oneOf that keeps the original schema as one of the alternatives is now the new request-body-wrapped-in-one-of-original-preserved / response-body-wrapped-in-one-of-original-preserved at warning level, with a comment explaining the residual risk; a wrapping where no alternative accepts what the original did keeps the error.

New checks

• 44 constraint-keyword checks (#​1174). maxItems, maxProperties, minProperties, multipleOf and uniqueItems were not checked at all; they now are, across request body, property and parameter and the response side, in both directions, including read-only variants and the multipleOf generalized/specialized cases where one bound divides the other. The multipleOf comparison is exact rational arithmetic, so 0.3 to 0.1 is a generalization and a ratio merely close to an integer is not (#​1205).
• 14 boolean-schema checks (#​1191, #​1203). See below.

Boolean schemas (OpenAPI 3.1)

• true and false schemas load and diff (#​1184, #​1191). A schema written as a JSON Schema boolean failed to parse before; it now loads, and the diff models it. A schema becoming false accepts nothing: the new *-schema-became-false checks report it as an error on the request side and for a response body (the client's media type can no longer be inhabited), across body, property, parameter, parameter property and response header. The reverse transitions report as *-schema-became-not-false. A change between {} and true is a document edit with no contract effect: visible in oasdiff diff, silent in the changelog.
• Closing a tuple with items: false is detected (#​1203). Adding items: false to a schema that had no items invalidates every array longer than the prefix and previously reported nothing.
• A schema arriving as false or true is classified, not just counted (#​1191). A media-type schema added as false reports as schema-became-false instead of an informational "schema added", and one added as true or {} (which accepts exactly what the absent schema accepted) reports nothing instead of a spurious error on the request side.

prefixItems is positional

• Reordering entries is detected (#​1192). prefixItems entries were matched as an unordered set, so swapping [string, integer] to [integer, string] reported no change when every position now validates against a different schema. Entries are now paired by index, so a reorder or in-place edit reports as a located type change (prefixItems[subschema #​1]), and oasdiff diff shows per-position modifications.
• prefixItems verdicts follow the items schema (#​1200). An entry that restates the items schema it displaces changes nothing and now reports nothing; otherwise the eight added/removed checks report a warning with a comment explaining why the direction cannot be determined: an added entry constrains an open position when items is absent but lengthens the tuple when items is false, so the old fixed verdicts (info one way, error the other) asserted a direction the spec does not fix.

OpenAPI 3.2

• QUERY and custom methods are compared (#​1135). Operations under the 3.2 query field and additionalOperations map were invisible to the diff (parked in extensions, then skipped by the fixed method list); they are now diffed like any other operation.
• New validate rules for 3.2 and boolean schemas (#​1184). additional-operations-*, query-field-for-3-2-plus, boolean-schema-for-3-1-plus and boolean-schema-with-other-keywords join oasdiff validate.

New commands

• oasdiff breaking-files checks each changed spec against a git ref (#​1183, thanks @​ChrisJr404): one comparison per spec against the same path in the ref, an aggregated exit code, and a skip with a fetch hint for specs not in the base. Designed for pre-commit hooks; an example .pre-commit-config.yaml ships in examples/.
• oasdiff checks changelog coverage shows what the checker covers (#​1174). Every possible edit to an OpenAPI document, derived mechanically from the object model (5,564 locations, 15,255 edits), with the checks that cover it or the reason it is waived. --tags filters by direction, area, kind, action and status; --patterns lists the claim patterns. Uncovered edits and stale waivers fail the build, so the coverage listing is enforced, not aspirational.

Misc

• oasdiff validate findings always carry a line and column (#​1177). duplicate-required-field and duplicate-tag reported a file with no location.
• An unsupported --template format is rejected before the specs load (#​1178), like the equivalent --color mismatch, instead of after the full diff run.
• Localization is complete and enforced (#​1202). Six response-header checks had no description in any language and one message was missing in Russian; a test now fails on any check id without a message and description in every locale.

Go package changes

• Rule metadata is public: checker/rules (#​1174). Every rule declares its Direction, Area, Kind, Effect (widens, narrows, incomparable, unknown, none, violation) and Guards, and checker.BackwardCompatibilityRule carries them. Severity is derived from that metadata by a law enforced in tests: narrowing a request or widening a response is an error, the reverse is info, undecidable is a warning. checker/metaschema (the edit-space model) and checker/coverage (the audit) are new packages.
• diff understands boolean schemas (#​1191). SchemaDiff.AlwaysDiff carries transitions of the JSON Schema boolean form, and SchemaRefsValidationEquivalent treats true as the empty schema while keeping false distinct.
• diff pairs prefixItems by index (#​1192). SchemaDiff.PrefixItemsDiff reports positional modifications instead of set-matched additions and deletions; consumers of the diff JSON see modified entries where reorders previously produced nothing. PrefixItemsValidationEquivalent reports whether two schemas validate every prefix-covered position identically (#​1200), and OneOfWrappingDiff.OriginalPreserved reports whether a oneOf wrapping keeps the base schema as an alternative (#​1174).
• Color primitives moved to a colorize package (#​1174). checker keeps type and constant aliases, so existing callers compile unchanged.
• Breaking: the unused checker/generator package is removed (#​1174).

Misc

• Builds lift to Go 1.26.7 (#​1202). The toolchain directive picks up standard-library security fixes (crypto/tls, net/url, html/template, encoding/asn1) for release binaries, go install builds and local builds alike; golang.org/x/text moves past CVE-2026-56852.

v1.29.1

Compare Source

--flatten-allof now flattens what your diff actually reads

A single-fix release: schemas reached through a $ref (the most common shape in real specs) were escaping allOf flattening entirely, so --flatten-allof often had no effect. Anyone using the flag with oasdiff breaking or changelog (via the CLI, GitHub Action, or Docker image) will see the flag start doing its job on these specs, with sharper verdicts and cleaner property paths.

CLI changes

--flatten-allof

• allOf is now merged where a schema is used, not only where it is defined (#​1154). A $ref is a separate reference sharing the definition's schema value, and the merger previously repointed only the definition's reference, leaving every use of the schema (for example schema: { $ref: '#/components/schemas/Pet' } under a response) reading the unmerged original. Since the diff traverses schemas through their uses, an allOf reached under a $ref survived --flatten-allof completely, and oasdiff breaking --flatten-allof could produce output identical to running without the flag. The merged content is now written into the schema every $ref already points at, so flattening takes effect at the point of use. Serialized output of oasdiff flatten was already correct and is unchanged.
• Expected output changes when the fix kicks in (#​1154). On specs that hit this bug, property paths lose their allOf[...] prefix (the branch is no longer part of the path), verdicts sharpen where a sibling allOf branch previously hid a change, and changes under such an allOf stop carrying the unmerged-allOf disclaimer, which had been advising users to pass a flag they had already passed. All three are the intended behaviour of the flag, now applied consistently.

v1.29.0

Compare Source

OpenAPI 3.2 streamed bodies, honest verdicts under unflattened allOf, sharper severities

oasdiff now checks the contract of streamed bodies (SSE, JSON Lines) via OpenAPI 3.2's itemSchema, tells you when a verdict rests on an allOf it could not compare exactly (and caps it at warning), reports a removed response schema as the error it always was, and stops the allOf flattener from dropping sixteen OpenAPI 3.1 keywords.

CLI changes

OpenAPI 3.2 streamed bodies (itemSchema)

• Changes to streamed item schemas are now detected (#​1139). An OpenAPI 3.2 media type can carry an itemSchema typing each item of a streamed body (an SSE event, a JSON Lines record); oasdiff previously ignored it, so a breaking change to a streamed item's contract came back clean. All existing body checks now run against the item schema as well as the body schema, with an (item schema) marker on the message so you can tell which one changed. Five new change IDs cover an item schema appearing or disappearing: request-body-media-type-item-schema-added, response-body-media-type-item-schema-removed, and response-body-media-type-item-schema-removed-untyped are errors; the reverse directions are info. docs/OPENAPI-31.md gained a 3.2 section.
• Enum and property-stability checks cover streamed items too (#​1143, #​1151). These checks were moved onto the shared media-type traversal, which also fixed a real output gap: enum changes on a body with multiple media types now say which media type they belong to, e.g. request body enum value removed 'b' (media type: application/json), instead of printing two indistinguishable lines.

Disclaimers: saying what the comparison could not see (#​1147)

• Changes inside an unflattened allOf are capped at warning, with an explanation. Without --flatten-allof, oasdiff compares allOf branches one by one, so it cannot tell whether a sibling branch still provides what one branch dropped. Such verdicts previously came out as flat errors that could vanish (or appear) when the flag was added. They are now reported at most as warnings, with an appended note naming the uncertainty and the flag that resolves it, and a disclaimers array (["all-of-not-flattened"]) in json and yaml output. A level you set explicitly via --severity-levels still wins over the cap.
• request-body-all-of-added now reports warning instead of error as a consequence: on its own fixture, --flatten-allof reports nothing, so the unconditional error was a false positive.
• The required-version-bump check follows the reported level. It previously read each rule's declared level, so a change downgraded to warning by a disclaimer still demanded a major version bump. It now reads the level actually reported for the change.

Severity correction

• Removing a response schema is now an error (#​1142). response-body-media-type-schema-removed was a warning while both the change that contains it (removing the media type) and the change it contains (removing one required property) were errors. A media type with no schema places no constraint on the body at all, so every guarantee the consumer had is gone. oasdiff breaking reports the same set of changes as before, but pipelines gating on --fail-on ERR that tolerated this will now fail, which is the point of the change.

Flatten

• Sixteen OpenAPI 3.1 keywords are no longer dropped by the allOf flattener (#​1145). unevaluatedProperties, if/then/else, dependentSchemas, and thirteen more JSON Schema 2020-12 keywords on the outer schema were silently lost from every merge, including a schema with no allOf at all, so a closed schema became open and whole validation branches disappeared from --flatten-allof comparisons. They now pass through, and oasdiff diff between a spec and its flattened output no longer reports the loss. A keyword on an allOf subschema is still not merged; docs/ALLOF.md documents that remaining limitation.

Misc

• Encrypted review uploads identify the client software (#​1138). The upload's User-Agent is now oasdiff-cli/<version> (plus the CI platform when one is declared, e.g. github-actions) instead of an unversioned oasdiff-cli. Nothing identifying is added; this names the client, not the user.

Go package changes

Disclaimers surface

• Breaking: the checker.Change interface gained GetDisclaimers() []Disclaimer (#​1147). Any external implementation of Change must add the method (returning nil is fine; ComponentChange and SecurityChange do exactly that). ApiChange carries a new Disclaimers field and a WithDisclaimers method, which is additive and de-duplicating, and the new checker.Disclaimer type serializes by name (all-of-not-flattened) in json and yaml.

Misc

• New diff.MediaTypeDiff.ItemSchemaDiff field (#​1139). A *SchemaDiff for the OpenAPI 3.2 itemSchema, serialized as itemSchema in diff output, alongside the existing SchemaDiff for the whole-body schema.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

c66992b:

Upstream OpenAPI spec

No API changes detected.

[github-actions]

No breaking changes from c66992b

No API changes detected after overlay.

[github-actions]

c66992b:

No API changes detected after overlay.