From 02efc538d054f6ac7187f6e197994d6916c5b70c Mon Sep 17 00:00:00 2001 From: fredbi Date: Mon, 6 Jul 2026 21:59:39 +0200 Subject: [PATCH] =?UTF-8?q?doc(blog):=20monthly=20report=20=E2=80=94=20Jun?= =?UTF-8?q?e=202026?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Frédéric BIDON Co-Authored-By: Claude --- docs/doc-site/blog/monthly/2026-06.md | 74 +++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) create mode 100644 docs/doc-site/blog/monthly/2026-06.md diff --git a/docs/doc-site/blog/monthly/2026-06.md b/docs/doc-site/blog/monthly/2026-06.md new file mode 100644 index 0000000..84fe42b --- /dev/null +++ b/docs/doc-site/blog/monthly/2026-06.md @@ -0,0 +1,74 @@ +--- +title: June 2026 +description: go-openapi & go-swagger activity in June 2026 — a security-hardening pass, the swag/jsonpointer dependency reshuffle, and the new codescan repository. +weight: 797393 +discord_description: |- + A security-focused month, alongside two structural moves: + + • **Security hardening, org-wide** — **swag** sandboxes local file loading behind `WithRoot` (**GHSA-v2xp-g8xf-22pf**), **loads** gains secure loaders and containment options, and **go-swagger** hardens the generator against untrusted-spec injection. CI/workflow hardening landed across **ci-workflows**, **go-swagger** and **testify**. + • **swag / jsonpointer reshuffle** — **jsonpointer** was split into specialized sub-package modules, dropped the default `mailru/easyjson` dependency, and grew a new JSON-name provider; **swag** deprecated its `jsonname` module in turn. Big releases: **jsonpointer v0.24.0**, **swag v0.27.0**. + • **New repo: go-openapi/codescan** — the code scanner behind `swagger generate spec` is now its own repository (**v0.35.0**), with a Hugo docs site and a grammar preprocessor; **go-swagger v0.35.0** wires up to it. + • **testify v2.6.0** — go1.26 `ErrorAsType`/`NotErrorAsType` assertions, nil/cyclic-input guards, and fuzz tests. + + 602 commits across 17 repositories. Thanks to **@youdie006**, **@uddeshsingh** and **@dashitongzhi** for their contributions. +--- + +go-openapi and go-swagger had an active June, with **602 commits across 17 repositories**. The +month leaned heavily on **security hardening** — sandboxed file loading, secure spec loaders, +and generator/CI defenses — while two structural moves reshaped the libraries: the +**swag / jsonpointer dependency reshuffle** and the extraction of go-swagger's code scanner +into a new **go-openapi/codescan** repository. + +## Themes + +- **Security hardening, across the board.** **swag** now sandboxes local file loading behind a + `WithRoot` option (**GHSA-v2xp-g8xf-22pf**) and documents the loader's security implications; + **loads** added secure loaders and containment options; **go-swagger** hardened generated + code against untrusted-spec injection and sanitized its examples/artifact CI workflows; + **ci-workflows** and **testify** received coverage- and secret-handling hardening. +- **The swag / jsonpointer reshuffle.** **jsonpointer** was refactored into specialized + sub-package modules, dropped `mailru/easyjson` as a default dependency, removed most remaining + external dependencies, and gained a new `jsonname` provider that better respects Go naming + conventions; **swag** deprecated its own `jsonname` module (moved to jsonpointer) and added a + generic `sync.Pool` factory. Shipped as **jsonpointer v0.24.0** and **swag v0.27.0**. +- **A new repository: go-openapi/codescan.** The spec code-scanner previously living inside + go-swagger is now a standalone repo, complete with a Hugo documentation site scaffold, a + grammar preprocessor, and a deterministic golden-test harness; **go-swagger** was updated to + consume **codescan v0.35.0** for `swagger generate spec`. +- **testify assertions for go1.26.** New `ErrorAsType` / `NotErrorAsType` assertions with + go-version-guarded codegen, plus guards against nil interfaces and cyclic inputs in the + reflection walkers, and new fuzz tests. Released as **v2.6.0**. +- **go-swagger codegen fixes.** Explicit casing for `x-go-name` is now preserved (#3319, #3357), + an initialisms regression from v0.34.0 was fixed, and an opt-in `--with-stringer` generates + model `String()` methods. +- **Docs alignment and CI cadence.** Documentation was aligned with the org template across many + libraries, a shared **webhook-announcements** workflow (Discord) was added, and the all-time + contributors workflow moved from a weekly to a monthly schedule. + +## Repository highlights + +| Repository | Latest release | Highlights | +|---|---|---| +| swag | v0.27.0 | Sandboxed local loading via `WithRoot` (GHSA-v2xp-g8xf-22pf); generic `sync.Pool` factory; `jsonname` module deprecated | +| jsonpointer | v0.24.0 | Split into specialized sub-package modules; default `mailru/easyjson` dependency dropped; new `jsonname` provider | +| go-swagger | v0.35.0 | Generator hardened against untrusted-spec injection; `x-go-name` casing preserved; opt-in `--with-stringer`; wired to codescan v0.35.0 | +| codescan | v0.35.0 | New repository — code scanner extracted from go-swagger; Hugo docs site; grammar preprocessor | +| testify | v2.6.0 | go1.26 `ErrorAsType`/`NotErrorAsType` assertions; nil/cyclic-input guards; fuzz tests | +| loads | v0.24.0 | Secure loaders and containment options | +| runtime | v0.32.4 | nil-guard for `param.Schema` in the `UntypedRequestBinder` map path | +| validate | v0.26.0 | Warn on dubious `$ref` locations; pool-redemption race fix | +| strfmt | v0.26.4 | Validate `uri` format for absolute URIs carrying a fragment | +| spec | v0.22.6 | Header extension now marshals correctly as JSON | +| ci-workflows | v0.4.0 | New `webhook-announcements` shared workflow; coverage security hardening | + +> A quarterly report covering this period in more depth will follow. + +## Thanks to our contributors + +A warm thank-you to the external contributors who landed changes this month: + +- **[@youdie006](https://github.com/youdie006)** — go-swagger +- **[@uddeshsingh](https://github.com/uddeshsingh)** — go-swagger +- **[@dashitongzhi](https://github.com/dashitongzhi)** — go-swagger + +Your contributions are genuinely appreciated.