June 2026
go-openapi and go-swagger had an active June, with 602 commits across 17 repositories. The month leaned heavily on security hardening — sandboxed file loading, secure spec loaders, and generator/CI defenses — while two structural moves reshaped the libraries: the swag / jsonpointer dependency reshuffle and the extraction of go-swagger’s code scanner into a new go-openapi/codescan repository.
Themes
- Security hardening, across the board. swag now sandboxes local file loading behind a
WithRootoption (GHSA-v2xp-g8xf-22pf) and documents the loader’s security implications; loads added secure loaders and containment options; go-swagger hardened generated code against untrusted-spec injection and sanitized its examples/artifact CI workflows; ci-workflows and testify received coverage- and secret-handling hardening. - The swag / jsonpointer reshuffle. jsonpointer was refactored into specialized
sub-package modules, dropped
mailru/easyjsonas a default dependency, removed most remaining external dependencies, and gained a newjsonnameprovider that better respects Go naming conventions; swag deprecated its ownjsonnamemodule (moved to jsonpointer) and added a genericsync.Poolfactory. Shipped as jsonpointer v0.24.0 and swag v0.27.0. - A new repository: go-openapi/codescan. The spec code-scanner previously living inside
go-swagger is now a standalone repo, complete with a Hugo documentation site scaffold, a
grammar preprocessor, and a deterministic golden-test harness; go-swagger was updated to
consume codescan v0.35.0 for
swagger generate spec. - testify assertions for go1.26. New
ErrorAsType/NotErrorAsTypeassertions with go-version-guarded codegen, plus guards against nil interfaces and cyclic inputs in the reflection walkers, and new fuzz tests. Released as v2.6.0. - go-swagger codegen fixes. Explicit casing for
x-go-nameis now preserved (#3319, #3357), an initialisms regression from v0.34.0 was fixed, and an opt-in--with-stringergenerates modelString()methods. - Docs alignment and CI cadence. Documentation was aligned with the org template across many libraries, a shared webhook-announcements workflow (Discord) was added, and the all-time contributors workflow moved from a weekly to a monthly schedule.
Repository highlights
| Repository | Latest release | Highlights |
|---|---|---|
| swag | v0.27.0 | Sandboxed local loading via WithRoot (GHSA-v2xp-g8xf-22pf); generic sync.Pool factory; jsonname module deprecated |
| jsonpointer | v0.24.0 | Split into specialized sub-package modules; default mailru/easyjson dependency dropped; new jsonname provider |
| go-swagger | v0.35.0 | Generator hardened against untrusted-spec injection; x-go-name casing preserved; opt-in --with-stringer; wired to codescan v0.35.0 |
| codescan | v0.35.0 | New repository — code scanner extracted from go-swagger; Hugo docs site; grammar preprocessor |
| testify | v2.6.0 | go1.26 ErrorAsType/NotErrorAsType assertions; nil/cyclic-input guards; fuzz tests |
| loads | v0.24.0 | Secure loaders and containment options |
| runtime | v0.32.4 | nil-guard for param.Schema in the UntypedRequestBinder map path |
| validate | v0.26.0 | Warn on dubious $ref locations; pool-redemption race fix |
| strfmt | v0.26.4 | Validate uri format for absolute URIs carrying a fragment |
| spec | v0.22.6 | Header extension now marshals correctly as JSON |
| ci-workflows | v0.4.0 | New webhook-announcements shared workflow; coverage security hardening |
A quarterly report covering this period in more depth will follow.
Thanks to our contributors
A warm thank-you to the external contributors who landed changes this month:
- @youdie006 — go-swagger
- @uddeshsingh — go-swagger
- @dashitongzhi — go-swagger
Your contributions are genuinely appreciated.