doc(blog): monthly report — June 2026

docs/doc-site/blog/monthly/2026-06.md

@@ -0,0 +1,74 @@
+---
+title: June 2026
+description: go-openapi & go-swagger activity in June 2026 — a security-hardening pass, the swag/jsonpointer dependency reshuffle, and the new codescan repository.
+weight: 797393
+discord_description: |-
+  A security-focused month, alongside two structural moves:
+
+  • **Security hardening, org-wide** — **swag** sandboxes local file loading behind `WithRoot` (**GHSA-v2xp-g8xf-22pf**), **loads** gains secure loaders and containment options, and **go-swagger** hardens the generator against untrusted-spec injection. CI/workflow hardening landed across **ci-workflows**, **go-swagger** and **testify**.
+  • **swag / jsonpointer reshuffle** — **jsonpointer** was split into specialized sub-package modules, dropped the default `mailru/easyjson` dependency, and grew a new JSON-name provider; **swag** deprecated its `jsonname` module in turn. Big releases: **jsonpointer v0.24.0**, **swag v0.27.0**.
+  • **New repo: go-openapi/codescan** — the code scanner behind `swagger generate spec` is now its own repository (**v0.35.0**), with a Hugo docs site and a grammar preprocessor; **go-swagger v0.35.0** wires up to it.
+  • **testify v2.6.0** — go1.26 `ErrorAsType`/`NotErrorAsType` assertions, nil/cyclic-input guards, and fuzz tests.
+
+  602 commits across 17 repositories. Thanks to **@youdie006**, **@uddeshsingh** and **@dashitongzhi** for their contributions.
+---
+
+go-openapi and go-swagger had an active June, with **602 commits across 17 repositories**. The
+month leaned heavily on **security hardening** — sandboxed file loading, secure spec loaders,
+and generator/CI defenses — while two structural moves reshaped the libraries: the
+**swag / jsonpointer dependency reshuffle** and the extraction of go-swagger's code scanner
+into a new **go-openapi/codescan** repository.
+
+## Themes
+
+- **Security hardening, across the board.** **swag** now sandboxes local file loading behind a
+  `WithRoot` option (**GHSA-v2xp-g8xf-22pf**) and documents the loader's security implications;
+  **loads** added secure loaders and containment options; **go-swagger** hardened generated
+  code against untrusted-spec injection and sanitized its examples/artifact CI workflows;
+  **ci-workflows** and **testify** received coverage- and secret-handling hardening.
+- **The swag / jsonpointer reshuffle.** **jsonpointer** was refactored into specialized
+  sub-package modules, dropped `mailru/easyjson` as a default dependency, removed most remaining
+  external dependencies, and gained a new `jsonname` provider that better respects Go naming
+  conventions; **swag** deprecated its own `jsonname` module (moved to jsonpointer) and added a
+  generic `sync.Pool` factory. Shipped as **jsonpointer v0.24.0** and **swag v0.27.0**.
+- **A new repository: go-openapi/codescan.** The spec code-scanner previously living inside
+  go-swagger is now a standalone repo, complete with a Hugo documentation site scaffold, a
+  grammar preprocessor, and a deterministic golden-test harness; **go-swagger** was updated to
+  consume **codescan v0.35.0** for `swagger generate spec`.
+- **testify assertions for go1.26.** New `ErrorAsType` / `NotErrorAsType` assertions with
+  go-version-guarded codegen, plus guards against nil interfaces and cyclic inputs in the
+  reflection walkers, and new fuzz tests. Released as **v2.6.0**.
+- **go-swagger codegen fixes.** Explicit casing for `x-go-name` is now preserved (#3319, #3357),
+  an initialisms regression from v0.34.0 was fixed, and an opt-in `--with-stringer` generates
+  model `String()` methods.
+- **Docs alignment and CI cadence.** Documentation was aligned with the org template across many
+  libraries, a shared **webhook-announcements** workflow (Discord) was added, and the all-time
+  contributors workflow moved from a weekly to a monthly schedule.
+
+## Repository highlights
+
+| Repository | Latest release | Highlights |
+|---|---|---|
+| swag | v0.27.0 | Sandboxed local loading via `WithRoot` (GHSA-v2xp-g8xf-22pf); generic `sync.Pool` factory; `jsonname` module deprecated |
+| jsonpointer | v0.24.0 | Split into specialized sub-package modules; default `mailru/easyjson` dependency dropped; new `jsonname` provider |
+| go-swagger | v0.35.0 | Generator hardened against untrusted-spec injection; `x-go-name` casing preserved; opt-in `--with-stringer`; wired to codescan v0.35.0 |
+| codescan | v0.35.0 | New repository — code scanner extracted from go-swagger; Hugo docs site; grammar preprocessor |
+| testify | v2.6.0 | go1.26 `ErrorAsType`/`NotErrorAsType` assertions; nil/cyclic-input guards; fuzz tests |
+| loads | v0.24.0 | Secure loaders and containment options |
+| runtime | v0.32.4 | nil-guard for `param.Schema` in the `UntypedRequestBinder` map path |
+| validate | v0.26.0 | Warn on dubious `$ref` locations; pool-redemption race fix |
+| strfmt | v0.26.4 | Validate `uri` format for absolute URIs carrying a fragment |
+| spec | v0.22.6 | Header extension now marshals correctly as JSON |
+| ci-workflows | v0.4.0 | New `webhook-announcements` shared workflow; coverage security hardening |
+
+> A quarterly report covering this period in more depth will follow.
+
+## Thanks to our contributors
+
+A warm thank-you to the external contributors who landed changes this month:
+
+- **[@youdie006](https://github.com/youdie006)** — go-swagger
+- **[@uddeshsingh](https://github.com/uddeshsingh)** — go-swagger
+- **[@dashitongzhi](https://github.com/dashitongzhi)** — go-swagger
+
+Your contributions are genuinely appreciated.