chore: bump github.com/oasdiff/oasdiff from 1.15.2 to 1.15.3 in /tools/cli

[dependabot]

Bumps github.com/oasdiff/oasdiff from 1.15.2 to 1.15.3.

Release notes

Sourced from github.com/oasdiff/oasdiff's releases.

v1.15.3

Sharper breaking-change detection, hardened flatten, configurable config files

Crash fixes in the allOf flattener, an additionalProperties traversal fix that finally catches a long-missed class of breaking changes, scalar-to-array query-parameter generalization that is no longer flagged as breaking, and a richer config-file story (.oasdiff.*, --config, OASDIFF_CONFIG).

CLI changes

Detection rules

• additionalProperties is now walked when properties are added or deleted (#895, thanks @​prostomarkeloff). Removing or adding a required property inside a dict[str, X]-style response (additionalProperties: $ref, the default shape FastAPI / Pydantic emit for typed maps) was silently invisible to oasdiff breaking. The Modified processor already recursed; Added and Deleted now do too, so response-required-property-removed / -added and request-required-property-added fire on this shape as they always should have. Strictly additive: specs that did not exercise this path see no change.
• Scalar to form/explode array on a query parameter is no longer breaking (#915). Changing a query parameter's schema from a scalar X to an array of X is the OpenAPI 3 default-serialization (style: form, explode: true) generalization: ?color=red keeps working as a one-element array. The change is now reported as request-parameter-type-generalized at INFO level. Reverse direction (array to scalar), items-type mismatch, and path / header parameters (default simple, not form) remain breaking.

Config files

• .oasdiff.*, --config, and OASDIFF_CONFIG (#899). The preferred default config name is now .oasdiff.{json,yaml,yml,toml,hcl} (legacy oasdiff.* still works as a fallback). A new persistent --config <path> flag and OASDIFF_CONFIG env var let you point at an explicit file, with --config winning over the env var. When either override is set the file must exist; the cwd lookup keeps its silent-skip semantics.
• Path-valued config keys resolve relative to the config file (#901). err-ignore, warn-ignore, severity-levels, and template inside a config file now resolve relative to the config file's directory rather than the process's cwd, so --config examples/.oasdiff.yaml from the repo root finds sibling files as you'd expect. Absolute paths and CLI-supplied values are left alone.

Flatten allOf hardening

• Cyclic schemas no longer crash flatten allOf (#909). Self-referential schemas under allOf (a node whose property points back to itself, appearing twice in the merge) used to overflow the stack. The recursion sites in mergeProps, resolveItems, resolveContains, and resolvePropertyNames are now guarded with pointer-dedup plus an in-flight cycle map, so the cyclic link is preserved in the merged output.
• multipleOf: 0 no longer panics (#891). Two allOf siblings with multipleOf: 0 (invalid per spec, but seen in the wild) used to divide by zero in lcm(0, 0); non-positive values are now skipped.

OpenAPI 3.1 keywords in flatten/allOf

• contains is merged across allOf siblings (#888). contains: X + contains: Y flattens to contains: Merge(X, Y). Note: contains is existential (at least one item matches), so the merged form requires one item to satisfy both X and Y rather than allowing two distinct items, an over-constraint documented in docs/ALLOF.md. The flattened spec never accepts an array the original rejects.
• propertyNames is merged across allOf siblings (#902). propertyNames: X + propertyNames: Y flattens to propertyNames: Merge(X, Y). Unlike contains, propertyNames is universal (every name matches), so the merge is semantically faithful with no over-constraint caveat.

flatten command

• Flatten failures are no longer mis-wrapped as load failures (#908). oasdiff flatten /tmp/spec.yaml previously printed Error: failed to load original spec from "/tmp/spec.yaml": failed to flatten allOf in "/tmp/spec.yaml": ... (file path twice, wrong outer message). The CLI now distinguishes the two via a typed *load.FlattenError, prints the cleaner Error: failed to flatten allOf in "/tmp/spec.yaml": ..., and exits with code 122 instead of the load-failure code.

Misc

• Friendlier flag-parse errors (#919). pflag's raw strconv.ParseBool: parsing "x": invalid syntax style messages are rewritten to the flag's actual type: must be true or false for bool, must be an integer for int, must be a non-negative integer for uint, must be a number for float, must be a duration like 30s or 5m for duration. Wired once on the root command, so it propagates to every subcommand. Unrelated flag types fall through unchanged.

Go package changes

Breaking: functional options on Config types

• Breaking: checker.Config migrates to functional options (#911). The fluent WithOptionalCheck / WithOptionalChecks / WithSeverityLevels / WithDeprecation / WithSingleCheck / WithChecks / WithAttributes chain is removed; checker.NewConfig now takes ...Option arguments. Migration is mechanical (NewConfig(...).WithX(v) becomes NewConfig(..., WithX(v))), but every caller of the package needs the rewrite. Options are now first-class values: storable, composable, and passable independently of a receiver.
• Breaking: diff.Config migrates to functional options (#912). Same shape as checker.Config: WithExcludeElements and WithExcludeExtensions are now Option values passed to diff.NewConfig, and the chained methods are removed. Both packages now use the same idiom, so contributors don't have to remember which one uses which style.

Misc

• checker.CheckBackwardCompatibilityUntilLevel no longer mutates the caller's *diff.Diff (#913). The pipeline used to truncate PathsDiff.Deleted / per-path OperationsDiff.Deleted, delete keys from OperationsDiff.Modified for draft / alpha operations, and insert WebhooksDiff.Modified entries into PathsDiff.Modified under "webhook:..." keys, all in-place on the input. The function now clones PathsDiff and the nested fields the pipeline writes to before running checks. Callers that read the diff after running checks now see their original input intact.
• New typed *load.FlattenError (#908). Exposes Url and Err fields plus Unwrap(), reachable via errors.As. Lets library callers distinguish a flatten-stage failure from a load-stage failure when both can come out of load.NewSpecInfo.
• Change.Fingerprint is stable across copy edits and locale changes (#892). The 12-char fingerprint is now computed from the structured args rather than the rendered message text, so editing a message template or switching locales no longer invalidates every previously-stored fingerprint. One-way migration: fingerprints stored under the old algorithm will not match recomputed values.

Commits

• 83cdaf6 fix(cli): friendlier flag-parse error messages (#482) (#919)
• 79bab30 fix(checker): scalar to form/explode array is non-breaking for query params (...
• da960fb chore(checker): remove stale TODO.md (#916) (#917)
• 1186838 chore(checker): consolidate per-subdirectory test helpers (#906) (#914)
• 5f42e79 fix(checker): clone PathsDiff before mutating it during checks (#904) (#913)
• fa8923f chore(diff): migrate Config from fluent interface to functional options (#912)
• 3076ef9 chore(checker): migrate Config from fluent interface to functional options (#...
• 9151937 fix: gofmt alignment after argument-list shrink
• 5dcd304 chore(checker): use opInfo for the 5 diff-helper functions (#865)
• 22ba93f fix(flatten/allof): guard recursion sites against cyclic schemas (#890)
• Additional commits viewable in compare view

[yelizhenden-mdb]

@dependabot rebase

[yelizhenden-mdb]

@copilot alter the code to fix the following errors:
Error: internal/openapi/oasdiff.go:150:35: diff.NewConfig().WithExcludeElements undefined (type *diff.Config has no field or method WithExcludeElements)
Error: internal/openapi/oasdiff.go:460:35: diff.NewConfig().WithExcludeElements undefined (type *diff.Config has no field or method WithExcludeElements)

[Copilot]

@copilot alter the code to fix the following errors:
Error: internal/openapi/oasdiff.go:150:35: diff.NewConfig().WithExcludeElements undefined (type *diff.Config has no field or method WithExcludeEle...

Fixed in commit 8994288. In oasdiff v1.15.3, WithExcludeElements changed from a method on *diff.Config to a package-level Option function. Updated all 3 call sites (2 in oasdiff.go, 1 in oasdiff_result_test.go) from diff.NewConfig().WithExcludeElements(...) to diff.NewConfig(diff.WithExcludeElements(...)).

[yelizhenden-mdb]

@copilot alter the code to fix the problem:
Error: internal/changelog/changelog.go:359:27: checker.NewConfig(checker.GetAllChecks()).WithSeverityLevels undefined (type *checker.Config has no field or method WithSeverityLevels)

[Copilot]

@copilot alter the code to fix the problem:
Error: internal/changelog/changelog.go:359:27: checker.NewConfig(checker.GetAllChecks()).WithSeverityLevels undefined (type *checker.Config has no field or...

Fixed in commit 6dedef8. In oasdiff v1.15.3, WithSeverityLevels and WithDeprecation changed from chained methods to package-level Option functions. Updated changelog.go to use checker.NewConfig(checker.GetAllChecks(), checker.WithSeverityLevels(...), checker.WithDeprecation(...)).

[yelizhenden-mdb]

@copilot Fix this one: Error: test/e2e/cli/split_test.go:270:38: diff.NewConfig().WithExcludeElements undefined (type *diff.Config has no field or method WithExcludeElements) (typecheck)

[Copilot]

@copilot Fix this one: Error: test/e2e/cli/split_test.go:270:38: diff.NewConfig().WithExcludeElements undefined (type *diff.Config has no field or method WithExcludeElements) (typecheck)

Fixed in commit 3484368. Updated test/e2e/cli/split_test.go line 270 to use diff.NewConfig(diff.WithExcludeElements(examples)) instead of diff.NewConfig().WithExcludeElements(examples).