v0.22.7

0.22.7 - 2026-07-20

Full Changelog: v0.22.6...v0.22.7

17 commits in this release.

---

Implemented enhancements

• feat(expander): accept an option-aware document loader by @fredbi ...

Fixed bugs

• fix(ref): stop performing a network request in IsValidURI by @fredbi ...
• fix(expander): cap $ref expansion node count to prevent amplification DoS by @fredbi ...

Documentation

• doc: updated contributors file by @bot-go-openapi[bot] in #284 ...
• ci: post README announcements to discord + bump ci-workflows to v0.4.0 by @fredbi in #282 ...
• doc: updated contributors file by @bot-go-openapi[bot] in #280 ...

Miscellaneous tasks

• build(deps): bump swag modules to v0.27.3 by @fredbi ...
• chore: upgrade dependencies ; fix deprecated jsonname by @fredbi ...
• chore(ci): run contributors workflow monthly instead of weekly by @fredbi in #281 ...

Security

• test(expander): validate the SSRF posture of an injected loader by @fredbi ...
• docs(security): warn that the default $ref loader is not sandboxed by @fredbi ...

Updates

• build(deps): bump the go-openapi-dependencies group with 2 updates by @dependabot[bot] in #286 ...
• build(deps): bump the go-openapi-dependencies group with 6 updates by @dependabot[bot] in #285 ...
• build(deps): bump the go-openapi-dependencies group with 2 updates by @dependabot[bot] in #283 ...
• build(deps): bump go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml from 93b16765c4045dbd4dac2372803294298aa7592a to 2e57e83146e049b5dfb8116ba16a09b2da27b3c5 in the development-dependencies group by @dependabot[bot] in #279 ...

Other (technical)

• Fix/vuln reports by @fredbi in #290 ...
• build(deps): bump swag/loading to v0.27.2 for confined $ref loading by @fredbi ...

---

People who contributed to this release

• @fredbi

---

spec license terms