July 2026

go-openapi and go-swagger had a busy July, with roughly 80 load-bearing commits across 17 repositories. Two efforts dominated. The codescan repository — the code scanner behind swagger generate spec — was extended into a mono-repo and gained a new interactive genspec-tui, while a security-hardening pass ran across the spec toolchain, tightening $ref expansion and document loading in spec, swag and go-swagger and threading a confined loader down through loads, validate and analysis. Alongside these, three long-stable modules cut their first v1.0.0 releases.

Themes

• Security hardening across the spec toolchain. spec now caps $ref expansion node count to prevent amplification DoS, stops performing a network request in IsValidURI, accepts an option-aware document loader, and warns that the default $ref loader is not sandboxed. swag bounds recursion depth in its YAML↔JSON and ordered-JSON transforms and detects YAML anchor/alias expansion cycles. go-swagger escapes untrusted spec, header, flag, format, enum, default and content-type values in generated code, and adds codegen options to restrict $ref resolution. The confined/injectable loader was wired downstream into loads, validate and analysis.
• codescan as a mono-repo, plus genspec-tui. codescan was reorganized into a Go workspace mono-repo and shipped genspec-tui, an interactive TUI that live-renders a spec from its source. It also added swagger:omit as an escape hatch for embed conflicts, auto-discovery of discriminator subtypes for a referenced base type, and toolchain-independent TextMarshaler detection.
• New formats and features. strfmt added ISO-4217 currency and ISO-3166 country formats and an ISO 8601 / RFC 3339 duration-iso8601 format. Lazy multipart-form streaming landed as a runtime primitive and was surfaced through go-swagger’s generated servers and a new examples playground. spec gained confined ExpandSchemaWithOptions / ExpandParameterWithOptions / ExpandResponseWithOptions, and swag added AppendXXX number formatting and refactored its JSON-adapter pools and options.
• First v1.0.0 releases. jsonpointer, jsonreference and inflect each cut a v1.0.0 — a stability milestone for three of the oldest, lowest-churn modules.
• Portability and release plumbing. Windows fixes landed in swag (rooted/absolute in-root path handling) and codescan (LF golden fixtures on Windows checkouts); go-swagger reinstated Windows ARM64 binary releases; ci-workflows fixed edge cases in the mono-repo release flow.

Repository highlights

Thanks to our contributors

Thanks to the external contributors who landed changes this month:

• @fpawel — scaffolded the lazy multipart-form streaming feature across runtime, go-swagger and the examples.
• @KT-Doan — made TextMarshaler detection independent of the toolchain environment in codescan.
• @delthas — set http.Request.Pattern to the matched route in runtime middleware.
• @HNO3Miracle — made schema-validation fixtures deterministic in validate.
• @sanmaxdev — updated the client usage examples in go-swagger.

Special thanks for contributions that shaped the work even where the patch itself couldn’t be merged as-is:

• @bernot-dev — for the idea and an excellent parser implementation behind the ISO 8601 duration format in strfmt.
• @hsdfat — for a fast-turnaround enum fix in codescan.

Security advisories this month were responsibly reported by @KrisKennawayDD, @RamiAltai, @weiz-cn, @Gal3m, @EladMeged-Novee, @sondt99 and @abhayclasher — thank you.