chore(deps): bump the go-dependencies group across 1 directory with 2 updates

[dependabot]

Bumps the go-dependencies group with 2 updates in the / directory: github.com/getkin/kin-openapi and github.com/oapi-codegen/runtime.

Updates github.com/getkin/kin-openapi from 0.137.0 to 0.139.0

Release notes

Sourced from github.com/getkin/kin-openapi's releases.

v0.139.0

What's Changed

• feat(openapi3): batch-convert long-tail RequiredFieldError sites by @​reuvenharrison in getkin/kin-openapi#1170
• feat(openapi3): typed validation error clusters (combined: #1171-#1179) by @​reuvenharrison in getkin/kin-openapi#1180
• openapi3gen: skip component export for anonymous types by @​0-don in getkin/kin-openapi#1163
• feat: migrate to oasdiff/yaml v0.1.0 single Unmarshal API + enable DisableTimestamps by @​reuvenharrison in getkin/kin-openapi#1181
• openapi3: typed context errors for Validate() wrapper chain by @​reuvenharrison in getkin/kin-openapi#1183
• openapi3: track Origin on the document root (T) by @​reuvenharrison in getkin/kin-openapi#1184
• openapi3: tests flakiness corrected by @​fenollp in getkin/kin-openapi#1159
• openapi3: aggregate independent validation errors via EnableMultiError by @​reuvenharrison in getkin/kin-openapi#1185
• openapi3: fix validation of duplicated path templates by @​reuvenharrison in getkin/kin-openapi#1189
• openapi3: type the remaining bare-error validation sites by @​reuvenharrison in getkin/kin-openapi#1187

Full Changelog: getkin/kin-openapi@v0.138.0...v0.139.0

v0.138.0

What's Changed

• openapi3gen: clear nullable on exported component bodies by @​0-don in getkin/kin-openapi#1164
• openapi3: add test for issue #927 (nullable not respected on $ref schemas) by @​fenollp in getkin/kin-openapi#1165
• test: move public-API tests to external _test packages by @​fenollp in getkin/kin-openapi#1168
• feat(openapi3): add per-type validation errors with cluster wrappers by @​reuvenharrison in getkin/kin-openapi#1166
• feat(openapi3conv): canonicalization pass for 3.0 -> 3.x by @​reuvenharrison in getkin/kin-openapi#1162
• openapi3conv: test Upgrade on many documents by @​fenollp in getkin/kin-openapi#1169

Full Changelog: getkin/kin-openapi@v0.137.0...v0.138.0

Commits

• 8381bfc openapi3: type the remaining bare-error validation sites (#1187)
• d29b5c0 openapi3: fix validation of duplicated path templates (#1189)
• e56c2c7 openapi3: aggregate independent validation errors via EnableMultiError (#1185)
• 7ea1ac8 openapi3: tests flakiness corrected (#1159)
• dc70f84 openapi3: track Origin on the document root (T) (#1184)
• 69492df openapi3: typed context errors for Validate() wrapper chain (#1183)
• 0a89925 un-patch YAML serialization of dates (see issue #697)
• 55a4c72 openapi3: re-enable tests disabled due to YAML dates in map keys
• c61836c ci: fixup lint after modifications to marsh.go
• 7633481 feat: migrate to oasdiff/yaml v0.1.0 single Unmarshal API + enable DisableTim...
• Additional commits viewable in compare view

Updates github.com/oapi-codegen/runtime from 1.4.0 to 1.4.1

Release notes

Sourced from github.com/oapi-codegen/runtime's releases.

Bug fixes

This is a bug fix release.

Changes in v1.4.0, coupled with changes in v2.7.0 of oapi-codegen exposed some new problems. deepObject style marshaling behavior now supports encoding unicode. UTF-8 can't be directly included in parameters, so we need to % escape it.

Form binding now detects maps, which makes binding to a Nullable possible. We can't use generics around Nullable[T], so we handle maps generically, assuming they're a Nullable with its behavior assumptions.

🐛 Bug fixes

• Fix form binding of Nullables (#133) @​mromaszewicz
• Percent-encode deepObject parameter wire output (#132) @​mromaszewicz

📦 Dependency updates

• chore(deps): update oapi-codegen/actions action to v0.7.0 (#127) @renovate[bot]
• chore(deps): update github/codeql-action action to v4 (#107) @renovate[bot]
• fix(deps): update module github.com/kataras/iris/v12 to v12.2.11 (#11) @renovate[bot]
• chore(deps): update release-drafter/release-drafter action to v7.2.0 (#122) @renovate[bot]

Sponsors

We would like to thank our sponsors for their support during this release.

Commits

• 2755f15 Fix form binding of Nullables (#133)
• 17de1dd Percent-encode deepObject parameter wire output (#132)
• d2b7c4c chore(deps): update oapi-codegen/actions action to v0.7.0
• 6fd6c25 chore(deps): update github/codeql-action action to v4
• 19040cc fix(deps): update module github.com/kataras/iris/v12 to v12.2.11
• e05282e chore(deps): update release-drafter/release-drafter action to v7.2.0 (#122)
• See full diff in compare view

[koinsaari]

@dependabot rebase

[claude]

Claude finished @koinsaari's task in 1m 36s —— View job

---

Review: Dependency bump — kin-openapi + oapi-codegen/runtime

No blocking issues. This PR only modifies go.mod and go.sum; no application logic was changed.

github.com/getkin/kin-openapi 0.137.0 → 0.139.0
Two minor releases. Changes are additive: typed validation error clusters, multi-error aggregation via EnableMultiError, and a fix for duplicated path template validation. No breaking API changes. This project uses the library for OpenAPI spec loading via api/spec.go — the typed error additions don't affect callers that don't opt in.

github.com/oapi-codegen/runtime 1.4.0 → 1.4.1
Patch bug-fix release. Fixes form binding of Nullable types and percent-encoding of deepObject parameters in wire output. Both fixes are strictly correctness improvements; no API surface changes.

Core invariants (nothing changed here, confirming clean):

• No handler, service, or query code touched — pure data layer invariant unaffected
• No AuditFlags computation paths modified
• No change to validation ordering
• No new HTTP framework introduced

Checklist

• Read REVIEW.md and CLAUDE.md
• Analyzed PR changes (go.mod / go.sum only)
• Review findings posted
• Set commit status (skipped — GitHub App lacks statuses:write permission)