build(deps): bump github.com/oapi-codegen/oapi-codegen/v2 from 2.5.0 to 2.7.1 in /dev-tools

[dependabot]

Bumps github.com/oapi-codegen/oapi-codegen/v2 from 2.5.0 to 2.7.1.

Release notes

Sourced from github.com/oapi-codegen/oapi-codegen/v2's releases.

Security fix for Go code injection

This is a security fix for a code injection vulnerability in v2.7.0, please see:

GHSA-rjwr-m7qx-3fjr

[!NOTE] A vulnerability like this requires that it is missed in code review and that you then call the malicious method.

Using an init() function could be enough to not require a direct call to the code, and instead rely on you importing the package, but either way, code review should be performed before any oapi-codegen generated code is executed.

We strongly recommend all users to be reviewing changes to their generated code before they execute anything within it, to protect against supply chain attacks or malicious injected code.

This is also why we recommend oapi-codegen generated code is committed to source control.

We're more strict about escaping strings passed into the OpenAPI specification, so that people can't inject Go code into generated code.

The problem was that it was possible to craft a description for server URL's which would emit arbitrary Go code, so if an attacker controlled your specification, they could inject Go code into your generated code which could do something malicious.

v2.7.0: Squashing bugs, many bugs (and adding some features)

Many improvements and even more bug fixes

This v2.7.0 release of oapi-codegen contains quite a bit of internal refactoring, focused on our most historically fragile code paths, which relate to the aggregate types (allOf/anyOf/oneOf), $ref to external specs, enums, and the spec traversal logic missing quite a few leaf nodes where models should have been generated, but were skipped.

The biggest changes are explicitly described in the sections below, and the full list of commits is at the bottom.

Thank you to all contributors, we've been going through all past PR's and updating them and merging where we can, and thanks to all our users for reporting issues that you hit.

I've (@​mromaszewicz) used a lot of LLM help here to scrub through old issues and do some deep internal refactoring to address common problem areas. I intend to continue doing this, since the conditional generation logic is getting quite complicated. When I originally released oapi-codegen, the use case was much simpler, all the models were under #/components/schemas, and all the references to them were in the requests, responses, etc. I never imagine how many things would be external references or unions, and how many complex OpenAPI specifications people would be generating code for. The initial design was never flexible enough to handle that, so ongoing bug fixes are getting increasingly complex due to edge cases. This version has a lot of internal changes you won't see as a user, but the way we handle type generation internally is unifying lots of copy/paste re-implementations into reusable code for consistency. Most of these changes can be done transparently, but some can't, so, onto the changes:

Code generation changes which might require some changes on your end

This release contains three changes, all very narrow in scope, which will require some manual adjustment of your own code. We've decided that these are small enough and uncommon enough not to require opt-in, which causes internal complexity. It's always a judgment call with these. If we got it wrong, we're happy to revisit it in a maintenance release.

Strict-server external response refs require strict-server generation in both packages (#2357)

If your strict-server spec uses an external $ref to a components/responses/... defined in another spec, that other spec must also be generated with strict-server: true. Add it to the source spec's config and regenerate:

# config for the spec being $ref'd
generate:
  models: true
  strict-server: true   # now required when imported by a strict-server spec

This restores the v2.0.0 behavior that lets you cast response models across package boundaries — the standard pattern for sharing error models (e.g. a common 400) across services. PR #1387 had silently changed the embedded type from N400JSONResponse to the bare externalRef0.N400, so the local and external response structs no longer had matching types and casts stopped compiling.

Many more anonymous inner schemas are now hoisted into top level schemas

... (truncated)

Commits

• 19c6282 Improve string escaping and add tests (#2396)
• b363ca5 refactor(codegen): better Swagger compression, modern naming (#1909)
• 08b3018 Route server enums through general enums codegen (#2358)
• fbc8e0d revert external-ref carve-out in strict-server response embedding (#2010) (#2...
• 7517e09 respect output file path on gofmt failure (#2356)
• 9643421 fix example codegen (#2354)
• 036a54b per-operation middleware in Echo (#2353)
• 3338f93 Strict server: gate no-content response headers on nullable/optional (#2351)
• 218effe Synchronize strict servers (#2350)
• 81b9d95 Overhaul anonymous schema hoisting (#2348)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mergify]

This pull request does not have a backport label. Could you fix it @dependabot[bot]? 🙏
To fixup this pull request, you need to add the backport labels for the needed
branches, such as:

• backport-./d./d is the label to automatically backport to the 8./d branch. /d is the digit
• backport-active-all is the label that automatically backports to all active branches.
• backport-active-8 is the label that automatically backports to all active minor branches for the 8 major.
• backport-active-9 is the label that automatically backports to all active minor branches for the 9 major.

[ycombinator]

@copilot Address the CI failure.

[github-actions]

TL;DR

The failing :gcloud: Cloud e2e FIPS Test log only contains teardown output plus a generic exit status 1, so the actual failing command output is missing from the captured artifact. Immediate action: re-run this step and preserve full mage test:cloudE2ERun output so the real failure can be diagnosed.

Remediation

• Re-run cloud-e2e-fips-test (manual retry is enabled in pipeline) to rule out transient cloud/test infra failure.
• Capture and persist the pre-cleanup failure output from mage test:cloudE2ERun (or equivalent command trace) before the trap cleanup runs, so the first failing assertion/error is visible.
• If FLEET_SERVER_URL is empty on rerun, treat as cloud provisioning/config failure and inspect the test:cloudE2EUp / terraform apply phase rather than test logic.

Investigation details

Root Cause

This currently classifies as Infrastructure/observability failure (not yet a confirmed code regression) because the available log artifact does not include the original failing command output.

The job script is designed to always run cleanup via trap:

• .buildkite/scripts/cloud_e2e_test.sh:17-28 defines cleanup() and trap cleanup EXIT INT TERM.
• The likely failing phases are USER=fleetserverci mage ... test:cloudE2EUp (:30) or mage test:cloudE2ERun (:48), but their error output is absent in the captured log.
• The artifact only shows terraform destroy output and the final shell failure marker.

Evidence

• Build: https://buildkite.com/elastic/fleet-server/builds/16153
• Job/step: :gcloud: Cloud e2e FIPS Test / .buildkite/scripts/cloud_e2e_test.sh
• Key log excerpt:

  Destroy complete! Resources: 1 destroyed.
  🚨 Error: The command exited with status 1
  user command error: exit status 1
  

• Captured log has only 149 lines and starts mid-teardown, so the primary failure context is missing.

Verification

• Not run locally (cloud credentials/provisioning context required).

Follow-up

• I checked open flaky-test issues in this repo and found no match for this cloud FIPS failure signature.

---

What is this? | From workflow: PR Buildkite Detective

Give us feedback! React with 🚀 if perfect, 👍 if helpful, 👎 if not.

[mergify]

This pull request is now in conflicts. Could you fix it @dependabot[bot]? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b dependabot/go_modules/dev-tools/github.com/oapi-codegen/oapi-codegen/v2-2.7.1 upstream/dependabot/go_modules/dev-tools/github.com/oapi-codegen/oapi-codegen/v2-2.7.1
git merge upstream/main
git push upstream dependabot/go_modules/dev-tools/github.com/oapi-codegen/oapi-codegen/v2-2.7.1

[lorienhu]

@dependabot rebase

[dependabot]

Looks like this PR has been edited by someone other than Dependabot. That means Dependabot can't rebase it - sorry!

If you're happy for Dependabot to recreate it from scratch, overwriting any edits, you can request @dependabot recreate.