[dependabot]

Bumps the go-dependencies group with 1 update in the / directory: github.com/pb33f/libopenapi.

Updates github.com/pb33f/libopenapi from 0.40.1 to 0.41.6

Release notes

Sourced from github.com/pb33f/libopenapi's releases.

v0.41.6

Fixes seeded mock generation determinism.

@​tx3stn

v0.41.5

Added upgrades to the Go SDK generator to allow imperfect OpenAPI specs to generate correctly.

v0.41.4

Adds support for OpenAPI Overlays v1.2

v0.41.3

This release improves handling of malformed documents, schema comparisons, reference bundling, and reproducible mock generation.

• Parsing: Build valid sibling operations even when another operation fails, collect build errors, and avoid duplicate custom-operation builds.
• Schema comparison: Avoid false breaking-change reports when object schemas move into equivalent or broader anyOf/oneOf structures.
• Bundling: Correctly rewrite references inside vendor extensions, including pointers into nested schema properties.
• Mocks: Respect configured seeds for pattern-generated strings and produce stable XML element ordering.
• Tests: Add regression coverage for these fixes.

@​tx3stn @​matoous

v0.41.2

Update hashing performance. No fixes or features, just faster and more performant.

v0.41.1

Stop duplicating files referenced from arrays

@​mcstepp

v0.41.0

Harder, Better, Faster, Stronger

• Rendering Stripe: 77% faster
• Rendering DocuSign (JSON): 87% faster
• Inline-rendering every Stripe schema: 80% faster
• Building JSON specs: 54% to 69% faster
• Across the whole pipeline: 58% less time, 57% less memory, 61% fewer allocations

We forked the YAML library

First thing the fork fixed: the emitter kept every single event it ever wrote, for the entire document. Rendering Stripe now allocates 76% less memory, and bundling it 71% less.

Bonus: folded block scalars (>) no longer grow a blank line when rendered. Rendered output finally matches its source.

This one breaks things. Swap go.yaml.in/yaml/v4 for github.com/pb33f/go-yaml in your imports. The package is still called yaml, so it's a find and replace. If you pass *yaml.Node values in or out of libopenapi you have to do it, because the two node types are different types. jsonpath v0.8.4, ordered-map v2.3.2 and testify v0.1.1 have all made the same move.

Two small breaks in the low-level API

• NodeMap.Nodes is now a *low.NodeLines instead of a *sync.Map. Range, Load and Store take int line numbers, and Range visits lines in order. Most models get built and never read, so the line index only gets built when you ask for it.

... (truncated)

Commits

• c4c4be7 fix: seeded mock generation now gives the same output on every run
• 60b177e feat(generator): idiomatic Go SDK output for imperfect vendor specs
• 55aa758 fix: retain overlay action diagnostics
• cf93673 fix: preserve overlay input compatibility
• f44f114 test: cover cyclic Overlay alias rejection
• 84d17ae fix: preserve empty Overlay metadata strings
• 8132a72 fix: apply Overlay 1.2 action and merge rules
• 33bcfc6 feat: add Overlay 1.2 reusable action models
• ce94592 test: cover composed reference collision fallback
• 1704e72 chore: optimize composed ref lookup
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[Michael McQuade (giraffesyo)]

libopenapi 0.41 swaps go.yaml.in/yaml/v4 for its github.com/pb33f/go-yaml fork, which broke the JSON fast path from #139 (its nodes are the old library's type). The fork parses core's 3.3 MB spec in 13ms, down from about 60ms, so the fast path is only 3ms ahead now. I removed it rather than port it.

On core's spec: output is byte-identical to canary, generation takes 129ms median vs 143ms on canary, and cold build CPU is unchanged. go test -race ./... and golangci-lint pass.