security: vulnerability remediation

[kernel-internal]

Vulnerability Remediation

This PR was generated by the Socket-centric vulnerability remediation workflow. Review the planned dependency changes and confirmation evidence before merging.

Fixed

CVE/GHSA	Package	Ecosystem	Old Version	New Version	Manifest	Confirmation
GHSA-jpcw-4wr7-c3vq	github.com/getkin/kin-openapi	None	v0.133.0	0.144.0		confirmed

Not Included

• Deferred by batch limit: 30 advisories. They will be considered by future runs.
• Other deferred scanner findings: 257.
• Unconfirmed attempted fixes: 0.

Deferred details

CVE/GHSA	Package	Reason
Unavailable from detector	dario.cat/mergo	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Azure/go-ansiterm	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/Microsoft/go-winio	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/apapsch/go-jsonmerge/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cespare/xxhash/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/euank/go-kmsg-parser/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/grpc-ecosystem/grpc-gateway/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/oapi-codegen/oapi-codegen/v2	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/avast/retry-go/v5	Non-CVE alert is not handled by dependency remediation.
Unavailable from detector	github.com/cenkalti/backoff/v5	Non-CVE alert is not handled by dependency remediation.
...	...	247 additional items omitted from PR body. See workflow artifacts for full details.

---

Note

Low Risk
Dependency-only bump for an OpenAPI parsing library with no application logic changes; main risk is minor compatibility regressions in generated OpenAPI handling.

Overview
Bumps github.com/getkin/kin-openapi in server/go.mod from v0.133.0 to v0.144.0 to address GHSA-jpcw-4wr7-c3vq. server/go.sum is updated accordingly, including newer transitive pins (e.g. go-openapi/jsonpointer, oasdiff/yaml / yaml3, and additional go-openapi test/jsonschema modules pulled in by the upgrade).

There are no source changes—only lockfile/module metadata. kin-openapi is consumed via the oapi-codegen stack (e.g. server/lib/oapi), so runtime behavior should stay the same aside from the patched library version.

^{Reviewed by Cursor Bugbot for commit 7fb8334. Bugbot is set up for automated code reviews on this repo. Configure here.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	golang/​github.com/​getkin/​kin-openapi@​v0.133.0 ⏵ v0.144.0	+1	+75

View full report