Skip to content

fix: Security Scan fails on kin-openapi v0.144.0 CVEs #86

Open

Description

@nisargabd

Problem

Security Scan fails on every PR into development (#83, #84): 7 CVEs in
github.com/getkin/kin-openapi v0.144.0 (5 HIGH, 2 MEDIUM), used by
schemav2validator.

Failing run: https://github.com/OpenAgriNet/network-adapter/actions/runs/39206531179/job/117910479873

Why not just bump

  • v0.149.0 (Trivy's fix version): stops validating nested self-referencing
    schemas, so an invalid geometry inside a GeometryCollection is accepted.
  • v0.150.0+: stops checking const, so any context.version is accepted.

Fix

  • Bump kin-openapi to v0.150.0.
  • Add an explicit context.version == "2.0.0" check in schemav2validator.

Acceptance criteria

  • make build, make test and make trivy-gate pass
  • Wrong context.version and invalid nested geometry are still rejected, with tests
  • Extended (domain) schemas checked for other const use

Activity

  1. self-assigned this
    on Oct 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

Labels

bugSomething isn't working

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions