Fix/vuln reports#290

Merged

fredbi merged 8 commits into

go-openapi:masterfrom

fredbi:fix/vuln-reports

Jul 20, 2026

Commits on Jul 20, 2026

fix(expander): cap $ref expansion node count to prevent amplification DoS

fredbi
and
claude
committed
chore: upgrade dependencies ; fix deprecated jsonname
fredbi
committed
feat(expander): accept an option-aware document loader

fredbi
and
claude
committed
fix(ref): stop performing a network request in IsValidURI

fredbi
and
claude
committed
docs(security): warn that the default $ref loader is not sandboxed

fredbi
and
claude
committed
build(deps): bump swag/loading to v0.27.2 for confined $ref loading

fredbi
and
claude
committed
test(expander): validate the SSRF posture of an injected loader

fredbi
and
claude
committed
build(deps): bump swag modules to v0.27.3

fredbi
and
claude
committed